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ABSTRACT 


This  thesis  introduces  and  describes  a  software  tool  called  Mushroom  which 
automates  the  analysis  of  network  protocols  specified  by  the  Systems  of  Communicating 
Machines  (SCM)  and  the  Communicating  Finite  State  Machines  (CFSM)  models.  SCM  is 
a  formal  model  for  the  specification,  verification,  and  testing  of  communication  protocols. 
This  model  was  originally  developed  to  improve  the  CFSM  model  which  is  a  simpler  and 
earlier  Formal  E)escription  Technique  (FDT). 

The  program  is  developed  as  two  separate  programs  in  the  Ada  programming 
language.  The  flrst  program  automates  either  the  system  state  analysis  (Smart  Mushroom), 
or  the  full  global  analysis  (Big  Mushroom)  for  a  protocol  specified  by  the  SCM  model.  The 
second  program  called  Simple  Mushroom,  automates  the  global  reachability  analysis  for 
the  CFSM  model. 


Mushroom  greatly  facilitates  the  use  of  these  models  for  protocol  design  and  analysis. 
The  run  time  and  memory  efficiency  of  a  previous  program  was  improved  to  allow  the 
analysis  of  larger  and  more  complex  protocols.  The  program  was  also  extended  to  accept 
up  to  eight  machines  (processes)  in  the  protocol  speciflcation.  The  user  interface  of  the 
program  has  also  been  improved. 

Mushroom  has  been  used  to  verify  some  well  known  protocols  specified  by  the  SCM 
and  CFSM  models  such  as  the  token  bus  protocol.  Go  Back  N  and  Lap-B  data  link  control 
protocol. 
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I.  INTRODUCTION 


A.  MOTIVATION 

In  the  last  decade  increasing  complexity  in  computer  communication  systems  have 
created  a  growing  demand  for  formal  techniques  to  specify,  design,  verify  and  test 
protocols.  In  order  to  have  a  clear  understanding  of  the  protocols,  both  for  the  protocol 
designer  and  implementor,  it  is  essential  to  have  a  formal  protocol  specification. 

There  are  a  large  number  of  formal  techniques  available  for  modeling  protocols.  Most 
of  these  methods  can  be  placed  into  one  of  the  following  general  classifications  [Ref.  1]: 
communicating  finite  state  machines,  Petri  nets,  programming  languages  and  hybrids. 
Some  models  that  have  found  most  interest  and  chosen  for  standardization  are  ESTELLE, 
LOTOS  and  SDL.  Each  of  these  has  its  own  pros  and  cons. 

Systems  of  communicating  machines  (SCM)  is  also  a  formally  defined  model  for 
specification,  analysis  and  testing  of  protocols  that  is  defined  in  [Ref.  2].  This  model  uses 
a  combination  of  finite  state  machines  and  variables,  which  may  be  local  to  a  single 
machine  or  shared  by  two  or  more  machines,  so  it  can  be  classified  in  the  models  known  as 
“extended  finite-state  machines.”  The  main  goal  of  the  SCM  model  was  to  improve  the 
well-known  simpler  Communicating  Finite-State  Machines  (CFSM)  model.  The  SCM 
model  has  been  used  to  specify  and  analyze  several  protocols  [Ref.  3],  [Ref.  4],  [Ref.  5], 
[Ref.  6],  [Ref.  7].  Analysis  of  protocols  speciHed  with  this  model  can  be  executed  using  a 
method  called  system  state  analysis.  This  analysis  is  similar  to  global  reachability  analysis, 
but  generates  a  subset  of  all  reachable  states.  Sometimes  this  subset  is  sufficient  to  verify 
the  protocol.  In  some  cases  system  state  analysis  is  not  sufficient  for  protocol  analysis,  and 
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global  analysis  is  needed.  However,  it  is  possible  to  automate  the  system  state  analysis  and 
global  analysis  based  on  the  SCM  model. 

Several  tools  exist  for  the  design  and  verification  of  protocols.  These  tools  are  very 
important  for  increasing  the  usefulness  of  the  formal  description  techniques  (FDT). 

While  there  is  no  “perfect”  formal  specification  technique,  there  is  still  room  for  mwc 
work  to  understand  the  advantages  of  different  formal  models  and  develop  better  tools  to 
increase  the  utilization  of  these  models. 

B.  SCOPE  OF  THE  THESIS 

The  goal  of  the  thesis  is  to  present  a  software  tool,  called  mushroom  that  automates 
the  reachability  analysis  of  protocols  formally  speciHed  using  CFSM  and  SCM  models. 
The  name  mushroom  was  chosen  as  a  symbol  of  something  that  starts  out  relatively  small 
(specification)  and  gets  much  bigger  quickly  (analysis).  An  earlier  version  of  the  program 
[Ref.  8]  was  capable  of  generating  reachability  analysis  for  the  protocols  consisting  of  only 
two  machines.  This  thesis  expands  on  this  earlier  work  and  is  capable  of  analyzing 
protocols  that  has  any  number  of  machines  from  two  to  eight.  In  addition,  the  user  interface 
for  the  program  has  also  been  improved.  The  program  was  tested  against  results  of  several 
previous  works  and  has  confirmed  their  results.  It  is  also  believed  that  this  program  will 
help  to  solve  some  problems  concerning  the  SCM  model. 

C.  ORGANIZATION 

The  thesis  has  six  chapters.  Chapter  II  reviews  the  Communicating  Finite  State 
Machines  (CFSM)  and  Systems  of  Communicating  Machines  (SCM)  models.  In  Chapter 
III,  a  program  called  simple  mushroom,  which  automates  the  global  reachability  analysis 
based  on  CFSM  model,  is  described.  Chapter  IV  describes  a  program  that  automates  the 
system  state  analysis  (smart  mushroom),  or  the  full  global  analysis  (big  mushroom)  for 
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a  protocol  specified  formally  using  the  SCM  model.  In  Chapter  V,  some  examples  of  the 
use  of  the  program  are  given.  Chapter  VI  concludes  the  thesis  with  a  research  review  and 
suggestions  for  future  work. 
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11.  BACKGROUND  OF  MODELS 


A.  COMMUNICATING  FINITE  STATE  MACHINES 

Communicating  finite  state  machine  (CFSM)  model  is  a  simple  model  and  perhaps  the 
earliest  FDT.  In  this  model,  each  machine  in  the  network  is  modeled  as  a  finite  automaton 
or  finite  state  machine  (FSM),  with  communication  channels  between  pairs  of  machines 
modeled  as  one-way,  infinite  length  FIFO  queues.  There  is  a  great  deal  of  literature  on  this 
model  [Ref.  9]  [Ref.  10]  [Ref.  11].  The  model  is  defined  for  an  arbitrary  number  of 
machines;  however,  for  simplicity,  a  tv  o  machine  model  (shown  in  Figure  1)  will  be 
presented  here. 


Figure  1 :  CFSM,  2  machine  model  representation 


1.  Model  Definition 

This  section  defines  the  CFSM  model  [Ref  12]  and  provides  a  simple  protocol 
specification  and  analysis  to  clarify  the  definition. 

A  communicating  machine  M  is  a  finite,  directed  labeled  graph  with  two  types  of 
edges,  sending  and  receiving.  A  sending  (receiving)  edge  is  labeled  '-g'  (‘+g’)  for  some 
message  g,  taken  from  a  finite  set  G  of  messages.  One  of  the  nodes  in  M  is  identified  as  the 
initial  node,  and  each  node  is  reachable  from  the  initial  node  by  some  directed  path.  A  node 
in  M  whose  outgoing  edges  are  all  sending  (receiving)  edges  is  a  sending  (receiving)  node; 
otherwise  the  node  is  a  mixed  node.  If  the  outgoing  edges  of  each  node  in  M  have  distinct 
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labels,  then  M  is  deterministic,  otherwise  M  is  nondeterministic.  The  nodes  of  A/  are  often 
referred  to  as  suites',  these  two  terms  will  be  used  interchangeably  throughout  this  thesis. 

Let  M  and  N  be  two  communicating  machines  having  the  same  set  G  of  messages; 
the  pair  (M.  N)  is  a  network.  A  global  state  of  this  network  is  a  four  tuple  lm,c„,n,c„],  where 
m  and  are  nodes  (states)  from  M  and  N,  and  c„  and  c„  are  strings  from  the  set  G  of 
messages.  Intuitively,  the  global  state  [m,c„,n,c„]  means  that  the  machines  M  and  N  have 
reached  states  m  and  n,  and  the  communication  channels  contain  the  strings  c„  and  c„  of 
messages,  where  denotes  the  messages  sent  from  M  to  N\n  channel  Cj^,  and  c„  denotes 
the  messages  sent  from  to  Af  in  channel  C/^.  In  the  case  of  say  k  number  of  machines 
where  /:  >  2  the  global  state  can  be  represented  as 

[tnh<112><li3>-^2<Q2hQ23'-  ’f^3>Q3l'Q32 . ^  where  mfi  are  the  nodes  of 

machines  and  q^j  contains  the  messages  sent  from  Af,  to  Mj.  Subscripts  i  and  j  ranges 
from  I..k  and  i  *  j. 

The  initial  global  state  of  (M,M)  is  [mo,E,nQ,E],  where  mp  and  nq  are  the  initial 
states  of  M  and  N,  and  £  is  the  empty  string. 

The  network  progresses  as  transitions  are  taken  in  either  Af  or  N.  Each  transition 
consists  of  a  state  change  in  one  of  the  machines,  and  either  the  addition  of  a  message  to 
the  end  of  one  channel  (sending  transition)  or  the  deletion  of  a  message  from  the  front  of 
one  channel  (receiving  transition). 

A  sending  transition  in  M  (A/)  adds  a  message  to  the  end  of  channel  a 

receiving  transition  in  M  (AO  removes  a  message  from  the  front  of  channel  Q;  (C^)- 

Suppose  +g  is  a  receiving  transition  from  state  i  to  j  in  machine  Af  (AO.  The 
transition  can  be  executed  if  and  only  if  Af  {N)  is  in  state  i  and  the  message  g  is  at  the  front 
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of  the  channel  Cf^  The  execution  takes  zero  time.  After  its  execution,  machine  M  (AO 
is  in  state  j,  and  the  message  g  has  been  removed  from  the  channel 

Similarly,  suppose  -g  is  a  sending  transition  from  state  i  to  y  in  Af  (N).  The 
transition  can  be  executed  if  and  only  if  M  (N)  is  in  state  i.  Afterwards,  g  appears  on  the  end 
of  the  outgoing  channel,  and  the  machine  has  transitioned  to  state  j. 

Suppose  s/=  [m,Ci.n,Cj]  is  a  global  state  of  (M,N).  State  S2  follows  sj  if  there  is  a 
transition  (in  M  or  ^  which  can  be  executed  in  sj  if  there  is  a  sequence  of  states  Si,Si+j, . 
.,Si^.p  such  that  Sj  follov/s  follows  5,,  and  so  on,  and  S2  follows  Si+p.  A  state  s  is 

reachable  if  it  is  reachable  from  the  initial  state. 

The  communication  of  a  network(M,N)  is  bounded  if,  for  eveiy  reachable  state 
there  is  a  nonnegative  integer  A  such  that  lc;„l  <i(:  and  lc;,l  <  k,  where  let  denotes 
the  number  of  messages  in  channel  C. 

A  reachability  graph  of  a  network  (M,N)  is  a  directed  graph  in  which  the  nodes 
correspond  to  the  reachable  global  states  of  (M,N),  and  the  edges  represent  the  follows 
function.  That  is,  th'-re  is  an  edge  from  state  s,  to  state  Sj  if  and  only  if  Sj  follows  s,-.  The 
edges  are  labeled  with  the  transitions  which  they  represent.  This  reachability  graph  can  be 
generated  by  starting  with  the  initial  state,  and  adding  the  states  which  follow  it,  connecting 
them  to  it  with  edges;  and  repeating  for  each  new  state  generated. 

The  next  two  definitions  are  of  errors  that  may  occur  in  a  communication 
protocol,  which  are  detectable  by  analysis. 

A  global  state  [ni,c^,n,c„]  is  a  deadlock  state  if  both  m  and  n  are  receiving  nodes, 
and  c„=c^=E,  where  E  denotes  the  empty  string. 

A  global  state  [m,c„,n,c„]  is  an  unspecified  reception  state  if  one  of  the  following 
two  conditions  is  true: 
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(1)  m  is  a  receiving  state,  the  message  at  the  head  of  channel  c„  is  g,  and  none  of 
m’s  outgoing  transitions  is  labeled  *+g.' 

(2)  R  is  a  receiving  state,  the  message  at  the  head  of  channel  c„  is  g,  and  none  of 
n’s  outgoing  transitions  is  labeled  ‘+g.’ 

These  error  conditions  can  be  identifled  by  generating  the  reachability  graph  for 
a  network,  and  inspecting  all  states  as  they  are  generated. 

in  the  next  section,  an  example  protocol  is  specified  and  analyzed  using  the 
CFSM  model. 

2.  An  Example  of  Protocol  SpecificatitMi  and  Analysis  Using  CFSM 

CFSM  specification  of  an  imaginary  ring-like  network  consisting  of  three 
communicating  machines  is  shown  in  Figure  2. 


Machine  1  Machine  2 


Figure  2;  CFSM  specification  for  the  example  protocol 


It  is  assumed  that  the  protocol  is  used  at  the  data  link  layer,  making  use  of  the 
services  provided  by  the  physical  layer. 
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Edges  are  labeled  such  that  the  characters  following  the  *-/+’  shows  the  messages 
and  the  numbers  represent  the  destination  machine.  Each  machine  sends  one  message  to  the 
next  machine  and  receives  a  message  from  the  previous  machine  in  clockwise  direction 
forming  a  ring.  Ignore  the  dashed  edges  and  nodes  for  the  time  being.  The  initial  state  of 
each  machine  is  1;  thus  the  initial  global  state  is  [1,E,E«1>E>E.1>E.E]- 

The  reachability  analysis  can  be  done  by  a  simple  procedure.  Starting  with  the 
initial  global  state  only  one  transidon  is  possible,  the  '-DO'  of  the  machine  1  from  state  1. 
This  leads  to  global  state  [2,D0,E,1,E,E,1,E,E].  We  can  continue  the  analysis  in  the  same 
manner  detecting  the  possible  transitions  from  this  new  global  state.  The  complete 
reachability  analysis  is  given  in  Figure  3  consisting  of  a  total  of  six  states. 

- 1  ,E,E,  1  ,E,E,  1  ,E,E] 

I  *00.2 

[2,D0.E,1,E,E,1,E,E] 

I  +D0,1 

[2,E,E,2.E,E,1,E,E] 
j  -D1.3 

[2,E,E,1,E,D1,1,E,E] 

I  +D1,2 

I2,E.E,1.E,E,2,E,E] 

I  -D2,l 

I2,E,E,1,E,E.1,D2,E] 

I  +D2.3 

Figure  3;  Reachability  analysis  of  the  example  protocol 
In  this  sample  protocol,  there  are  no  deadlocks  or  unspecified  receptions.  If  the 
dashed  edges  and  states  in  Figure  2  are  added  to  the  specification,  the  reachability  analysis 
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shown  in  Figure  4  would  be  achieved.  In  this  analysis  there  is  one  deadlock  condition  and 
one  unspecified  reception.  In  global  state  [3,E,E,3.H,E,lf  JE],  all  the  channels  are  empty 
and  all  the  nodes  are  receiving  nodes  satisfying  the  deadlock  condition.  In  global  state 
[2,E,E,1,E>£>3,D4,E],  machine  1  and  machine  2  are  in  receiving  states  but  none  of  the 
outgoing  transitions  are  labeled  '+D4\  satisfying  an  unspecified  reception  condition. 


*.[1.E,E.1.E^,1.E,E1- 
I  -D0,2 

I2,D0,E,1,E,E,1,E,E1 
j  +D0,1 

I2,E,E,2.E,E,1,E,E] 
j  -D1.3 

[2,E,E.1,E,D1,1,E,E] 
I  +Dl,2 

[2,E.E,1,E,E.2,E,E]  - 
I  -D2,l 

[2,E,E,1,E,E,1,D2,E] 

I  +D2,3 


-D3a 


[3X>3,E,1££,1,E,E1 
I  +D3,l 

t3.E.E.3,E.E,l£31 

Deadlock 


[2,E£,l,E,E,3JM,E] 

Unspecified 

Reception 


Figure  4:  Reachability  analysis  including  errors 

3.  Summary 

The  CFSM  model  is  simple  and  easy  to  understand.  However,  as  the  protocols 
become  more  complex,  this  model  becomes  difficult  to  use  due  to  a  combinatorial 
explosion  of  states.  The  analysis  might  not  terminate  if  the  queue  length  is  unbounded.  The 
number  of  states  in  the  reachability  graph  will  be  unmanageably  large  for  such  complex 
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protocols  even  if  the  queue  length  is  bounded.  A  computer  analysis  might  eventually 
terminate,  but  still  the  CPU  time  would  be  days  even  months,  obviously  impractical. 

Another  disadvantage  is  that  as  the  protocols  become  more  complex,  the 
specification  of  the  protocol  can  be  so  large,  consisting  of  many  states  and  transitions,  that 
it  makes  it  very  hard  to  understand  if  it  is  the  intended  specification.  Several  examples  are 
given  in  Chapter  V  that  show  the  largeness  of  analysis  for  some  protocols. 

B.  SYSTEMS  OF  COMMUNICATING  MACHINES 

In  this  section  the  SCM  model  is  described.  First  the  model  definition  is  given,  then 
the  algorithm  for  generating  the  system  state  analysis  is  described.  Finally  the  model  is  used 
for  specification  and  analysis  of  an  example  protocol  to  illustrate  the  important  aspects  of 
the  model. 

1.  Model  Definition 

A  system  of  communicating  machines  is  an  ordered  pair  C  =  (M.V),  where 

M={mi,m2,...,mn) 

is  a  finite  set  of  machines,  and 

V={vi,V2,...,vij) 

is  a  finite  set  of  shared  variables,  with  two  designated  subsets  /?,■  and  VP,  specified 
for  each  machine  m,-.  The  subset  /?,■  of  V  is  called  the  set  of  read  access  variables  for 
machine  m^,  and  the  subset  Wj  the  set  of  write  access  variables  for  m,-. 

Each  machine  m,  €  Mis  defined  by  a  tuple  (5,,s,Lj,N,,T,),  where 

(1)  5,  is  a  finite  set  of  states; 

(2)  s  €  5,  is  a  designated  state  called  the  initial  state  of  mf, 

(3)  L,  is  a  finite  set  of  local  variables'. 
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(4)  Ni  is  a  finite  set  of  names,  each  of  which  is  associated  with  a  unique  pair  (p,a), 
where  p  is  a  predicate  on  the  variables  Lj  u  and  a  is  an  action  on  the  variables  of  L/  u 
RiKjWi.  Specifically,  an  action  is  a  partial  function 

aiLiXRi-^LiXWi 

from  the  values  of  the  local  variables  and  read  access  variables  to  the  values  of 
the  local  variables  and  write  access  variables. 

(5)  T,:  Si  X  Ni  ->  Si  is  a  transition  function,  which  is  a  partial  function  riom  the 
states  and  names  of  mi  to  the  states  of  mi- 

Machines  model  the  entities,  which  in  a  protocol  system  are  processes  and 
channels.  The  shared  variables  are  the  means  of  communication  between  the  machines. 
Intuitively,  /?,  and  Wi  are  the  subsets  of  V  to  which  m,-  has  read  and  write  access, 
respectively.  A  machine  is  allowed  to  make  a  transition  from  one  state  to  another  when  the 
predicate  associated  with  the  name  for  that  transition  is  true.  Upon  taking  the  transition,  the 
action  associated  with  that  name  is  executed.  Hie  action  changes  the  values  of  local  and/or 
shared  variables,  thus  allowing  other  predicates  to  become  true. 

The  sets  of  local  and  shared  variables  specify  a  name  and  range  for  each.  In  most 
cases,  the  range  will  be  a  finite  or  countable  set  of  values.  For  proper  operation,  the  initial 
values  of  some  or  all  of  the  variables  should  be  speciried. 

A  system  state  tuple  is  a  tuple  of  all  machine  states.  That  is,  if  (Af,V)  is  a  system 
of  n  communicating  machines,  and  r,,  for  1<  i  <  n,  is  the  state  of  machine  mi,  then  the  n- 
tuple  (sj,S2,  -,s„)  is  the  system  state  tuple  of  (A/,V).  A  system  state  is  a  system  state  tuple, 
plus  the  outgoing  transitions  which  are  enabled.  Thus  two  system  states  are  equal  if  every 
machine  is  in  the  same  state,  and  the  same  outgoing  transitions  are  enabled. 

The  global  state  of  a  system  consists  of  the  system  state  tuple,  plus  the  values  of 
all  variables,  both  local  and  shared.  It  may  be  written  as  a  larger  tuple,  containing  the 
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system  state  tuple  with  the  values  of  the  variables.  The  initial  global  state  is  the  initial 
system  state  tuple,  with  the  additional  requirement  that  all  variables  have  their  initial 
values.  The  initial  system  state  is  the  system  state  such  that  every  machine  is  in  its  initial 
state,  and  the  outgoing  transitions  are  the  '.ame  as  in  the  initial  global  state. 

A  global  state  corresponds  to  a  system  state  if  every  machine  is  in  the  same  state, 
and  the  same  outgoing  transitions  are  enabled.  Cleariy,  more  than  one  global  state  may 
correspond  to  the  same  system  state. 

Let  X  is],n)  =  52  be  a  transition  which  is  defined  on  machine  m,.  Transition  t  is 
enabled  if  the  enabling  predicate  p,  associated  with  name  n,  is  true.  Transition  t  may  be 
enabled  whenever  m,  is  in  state  s,  and  the  predicate  p  is  true  (enabled).  The  execution  of  x 
is  an  atomic  action,  in  which  both  the  state  change  and  the  action  a  associated  with  n  occur 
simultaneously. 

It  is  assumed  that  if  a  transition  is  enabled  indefinitely,  then  it  will  eventually 
occur.  This  is  an  assumption  of fairness,  and  is  needed  for  the  proofs  of  certain  properties. 

2.  Algorithm:  System  State  Analysis 

The  process  of  generating  the  set  of  all  system  states  reachable  from  the  initial 
state  is  called  system  state  analysis.  This  analysis  constructs  a  graph,  whose  nodes  are  the 
reachable  system  states,  and  whose  arcs  indicate  the  transitions  leading  from  each  system 
state  to  another.  This  graph  may  be  generated  by  a  mechanical  procedure  which  consists  of 
the  following  three  steps  [Ref.  1]: 

1.  Set  each  machine  to  its  initial  state,  and  all  variables  to  their  initial  values.  The 
initial  set  of  reachable  system  states  consists  of  only  the  initial  system  state;  the 
initial  graph  is  a  single  node  representing  this  state. 

2.  From  the  current  system  state  vector  and  variable  values,  determine  which 
transitions  are  enabled.  For  each  of  these  transitions,  determine  the  system  state 
which  results  from  its  execution.  If  this  state  (with  the  same  enabled  transitions) 


12 


has  already  been  generated,  then  draw  an  arc  from  the  current  stare  to  it,  labelling 
the  arc  with  the  transition  name.  Otherwise,  add  the  new  system  stare  to  the  gr^h, 
draw  an  arc  from  the  current  state  to  it,  and  label  the  arc  with  the  name  of  the 
transition. 

3.  For  each  new  state  generated  in  step  2,  repeat  step  2.  Continue  until  step  2  has 
been  repeated  for  each  system  state  thus  generated,  and  no  more  new  states  are 
generated. 

3.  An  Example  of  Protocol  Specification  and  Analysis  Using  SCM 

The  specification  of  an  imaginary  ring-like  network  consisting  of  three  machines 
similar  to  the  CFSM  example  in  the  previous  section  is  given  in  Figure  5.  The  specification 
consists  of  the  finite  state  machines,  the  local  and  shared  variables,  and  the  predicate  action 
table,  shown  in  Table  1.  The  local  variables  are:  in  buffl,  in  bi^,  in  bi^,  outJ>i^l, 
out  bid,  and  out  bid  and  shown  under  the  corresponding  FSMs  with  their  initial 
values.  The  shared  variables  are:  CHANl,  CHAN2,  and  CHANS  and  shown  between  the 
two  machines.  The  initial  state  of  each  machine  is  0,  with  the  shared  variables  and  local 
variables  are  empty  except  the  local  variable  out_bufn,  which  has  data  in  it.  E  in  the 
predicate-action  table  shows  the  empty  string.  A  character  D  will  be  used  to  represent  the 
data  in  the  out_bufn  local  variable.  Other  notations  in  the  predicate-action  table  are 
intuitive. 

Each  machine  sends  one  message  to  the  next  machine  and  receives  a  message 
from  the  previous  machine  in  clockwise  direction  forming  a  ring.  The  global  reachability 
analysis,  shown  in  Figure  6,  has  12  states.  The  system  state  analysis,  shown  in  Figure  7,  has 
only  6  states.  The  subscripts  in  Figure  7  are  used  so  that  distinct  system  states  having  the 
same  tuple  (but  not  the  outgoing  transitions)  may  easily  distinguished. 
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Ml 


CHANl 


M2 


CHAN3 


M3 


hi.biriR  :E 
•M  bain  :E 


CHANl 


Figure  S:  FSMs  and  variables  for  the  example  protocol 


TABLE  1 :  PREDICATE-ACTION  TABLE  FOR  THE  EXAMPLE  PROTOCOL 


Transition 

Enabling  Predicate 

Action 

snd.datal 

CHANl  =  E  A 
oul_buffl  *  E 

CHANl  <-  out.bufTl 
out.buHl  <-  E 

rcv_dala3 

CHAN3)tE 

in.buffl  <-  CHAN3 
out_buffl «-  in.bulTl 

CHAN3  4-E 

siKi_data2 

CHAN2  =  E  A 
out_buff2  *  E 

CHAN2<-  out_bufr2 
oul_bufI2  «-  E 

rcv_daJal 

CHANl  *E 

in_buff2  «-  CHANl 
out_buff2  «-  in_bufI2 

CHANl  ♦-  E 

snd_data3 

CHAN3=EA 
<Hit_bufG  E 

CHAN3«-  out_bufn 
oul_bufB  «-  E 

rev_daia2 

CHAN2?tE 

in_bulT3 «-  CHAN2 
out_buff3  in_buff3 

CHAN2  <-  E 

14 


[m  I  .in.bufll  .out.bufTl  ^2.in_buff2^t_buff2^3  jn_buff3^t_buff3.CHAN  1  ,CHAN2,CHAN3] 
(O.E.D.O,E.E.O.E.E.E.E,E] 

I  snd.datal 

[l.E.E.O.E.E.O.E.E.D.E.E] 

I  rcv_datal 

[i.e.e.i.d.d.Ve.e.e.e.e] 

1  snd_daia2 

[l.E.E.O.D.E.O.E.E.E.D.E] 

I  rcv_daia2 

{  1  .E.E.O.D.E.UD.D.E.E.E] 

I  snd_daia3 

[l.E.E.O.D.E.O.D.E.E.E.D] 

I  rcv_data3 

[O.D.D,O.D.E.O.D.E.E.E.E]„ - 

I  snd.datal 

[l.D.E.O.D,E.O.D,E.D.E,E] 

1  rcv_daial 

H.D.E.l.D.D.D.D.E.E.E.E] 

1  snd_data2  icv_data3 

[l.D.E,O.D,E,O.D.E,E,D,E] 

I  rcv_data2 

[I.D.E.G.D.E.l.D.D.E.E.E] 

I  snd_daia3 

t 1 .D.E.O.D.E.O.D.E.E.E.Dl - 


Figure  6:  Global  reachability  analysis  for  the  example  protocol 


Thus,  for  this  protocol  we  have  6  system  states,  and  12  global  states.  For  more 
complex  protocols,  the  difference  between  these  numbers  can  be  much  more.  For  example, 
a  sliding  window  protocol  with  a  window  size  of  8  the  system  state  analysis  was  shown  to 
generate  165  states,  while  the  full  global  analysis  generated  11880  states  [Ref.  1]. 
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4.  Summary 

The  SCM  model  has  desirable  properties  which  overcome  some  of  the 
disadvantages  of  the  CFSM  model.  One  of  the  advantages  of  the  SCM  model  is  that  it 
greatly  reduces  the  number  of  state  explosion  through  the  use  of  system  state  analysis.  In 
some  cases,  however,  the  system  state  analysis  is  not  sufficient  for  protocol  analysis,  and 
some  other  method  -  such  as  global  analysis  -  must  be  done.  A  problem  with  the  system 
state  analysis  is  the  loops  in  the  state  machines  which  may  cause  an  insufficient  analysis. 
This  problem  is  illustrated  with  an  example  in  Chapter  V. 

Another  advantage  of  SCM  model  is  that  it  allows  communication  between 
machines  in  nonsequential  manner,  unlike  a  FIFO  queue  representation  in  the  CFSM 
model.  The  SCM  model  specification  is  also  easier  to  understand  than  the  CFSM  model  for 
more  complex  protocols. 
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ni.  SIMPLE  MUSHROOM:  A  PROGRAM  FOR  AUTOMATING  CFSM 

REACHABILITY  ANALYSIS 


This  Chapter  and  the  next  Chapter  will  ttescribe  a  program  called  mushroom,  which 
was  written  in  the  Ada  programming  language.  Mushroom  automates  the  reachability 
analysis  of  protocols  specified  by  the  CFSM  and  the  SCM  models.  The  Mushroom  program 
was  first  developed  as  two  separate  programs.  The  first  program  called  simple  mushroom, 
automates  the  CFSM  analysis.  The  second  program  automates  either  system  state  analysis 
(smart  mushroom),  or  the  full  global  analysis  (Mg  mushroom)  for  a  protocol  specified 
formally  by  the  SCM  model.  The  General  structure  of  the  Mushroom  program  is  shown  in 
Figure  8. 


Figure  8:  General  structure  of  Mushroom  program 


The  Simple  Mushroom  program,  is  described  in  this  chapter  in  four  sections:  program 
structure,  inputs  to  the  program,  generating  the  reachability  analysis,  and  outputs  of  the 
program. 

A.  PROGRAM  STRUCTURE 

The  Simple  Mushroom  program  consists  of  Ada  subprograms  (procedures  and 
functions),  which  are  separate  compilation  units  and  subunits  of  compilation  units.  Related 
subprograms  are  also  gathered  in  the  same  files.  The  compilation  units  of  the  program  are 
shown  in  Table  2.  Procedure  main  is  the  parent  unit.  All  of  the  subprograms  are  the 
subunits  of  procedure  main.  [Ref.  13] 


TABLE  2:  SIMPLE  MUSHROOM  PROGRAM  COMPILATION  UNITS 


Compilation  Unit 

Description 

File  name 

main  (procedure) 

This  is  the  parent  unit.  Contains 
the  main  data  structures,  global 
variables,  and  the  driver. 

tmain.a 

load_machine_array 

(procedure) 

Builds  the  adjacency  lists  from 
FSMs. 

tinputa 

read_in_file  (procedure) 

Parses  the  input  FSM  text  file. 

tinput.a 

build_Gstate_graph 

(procedure) 

Generates  the  reachability  graph. 

treachability.a 

IsEqual  (function) 

Compares  two  global  states  for 
equality. 

treachability.a 

hash  (function) 

Generates  an  index  number 
according  to  the  hashing  function. 

treachability.a 

clear_pointcrs  (procedure) 

Deallocates  the  dynamic  memory 
space  for  another  analysis. 

treachability.a 

find_tuple  (function) 

Searches  the  reachability  graph 
for  the  eouivalent  tuples  using 
external  (open)  hashing. 

tsearch.a 

Compilation  Unit 


Description 


File  Name 


clear_hash_array 

(procedure) 

Clears  the  hash  array  and 
deallocates  the  memory. 

tsearch.a 

Print  Queue  (procedure) 

Prints  the  FIFO  queues. 

toutputa 

output_Gstate_transition 

(procedure) 

Outputs  the  transition  name. 

toutput.a 

output_G3tate_node 

(procedure) 

Outputs  the  machine  states, 
unspecified  receptions,  and 
the  states  with  deadlocks. 

toutput.a 

output_machine_arrays 

(procedure) 

Outputs  the  FSM  description  in 
a  tabular  format. 

toutput.a 

output_unexecuted_transi- 
tions  (procedure) 

Outputs  the  unexecuted  transitions. 

toutput.a 

create_output_file 

(procedure) 

Creates  an  output  file  for  storing 
the  analysis  results. 

toutput.a 

output_analysis  (procedure) 

Driver  for  the  output  subprograms. 

toutput.a 

system_call  (procedure) 

Interface  procedure  for  Unix 
system  calls  via  C. 

tsystem.a 

message_queues 

(package) 

Implements  the  queue  operations 
for  the  FIFO  communication 
channels. 

tqueues.a 

pointer_queues 
(generic  package) 

Implements  the  queue  operations 
for  the  pointer  queue  that  stores  the 
globals  tuples  temporarily. 

queues_2.a 
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The  method  of  splitting  the  program  into  separate  compilation  units  has  permitted  a 
hierarchical  program  development. 


B.  INPUT 

The  CFSM  specification  of  a  protocol  consists  of  only  FSMs  of  the  communicating 
machines.  In  the  program,  FSMs  are  represented  with  a  text  file.  The  user  enters  the 
directed  graphs  as  a  text  file  using  some  reserved  words,  numbers,  and  characters 
representing  the  machines,  states  and  the  transitions.  The  list  of  reserved  words  and  the 
syntax  for  the  FSM  text  description  are  shown  in  Figure  9  in  Backus-Naur  Form  (BNF). 


reserved_word  ::=  stan 

I  number_of_machines 
I  machine 
I  state 
I  trans 

I  initial.state 
I  finish 

nuinber_of_iiiachme$  <machine_number> 
machine  1  I  <machine_number> 
state  <state_numbcr> 

trans  _  }<messagc><next_state><next_machine> 


initial_state  <state_number>  <state_number>  [<state_numbcr>]  [<statc_number>] 
[<state_numbcr>]  [<state_number>]  [<state_numbcr>]  [<state_number>] 


<machine_number>  ::=  2I3I4I5I6I7I8 
<state_numbcr>  ::=0I2I31 . 150 


<message> 


{<letter> 
<digit> 


m<lcttcr>  -I -ir  r<Ietter>  -i-i 

J  J  Ll<digit>  J  J 


<next_state>  :;=  <statc„numbcr> 
<next_machine>  II  <machine_number> 
<lcttcr>::=  albL.l2lAIBI...IZ 


<digit>  ::=  0I1I2I3I4I5I6I7I8I9 


Figure  9:  Syntax  for  the  text  description  of  FSM 


20 


As  can  be  seen  from  Figure  9,  the  maximum  number  of  machines  allowed  is  eight,  and 
the  number  of  states  for  each  machine  can  be  from  0  to  50.  Transition  names  must  be  at 
most  three  characters  long  and  may  be  any  combination  of  letters  or  digits.  These 
constraints  can  be  relaxed  with  slight  modifications  to  the  program,  if  necessary. 

The  input  file  for  the  example  protocol  in  Chapter  II  for  the  CFSM  model  is  shown  in 
Figure  10.  For  example,  “trans  -D3  3  2”  represents  a  transition  from  state  1  to  state  3  (first 
number)  in  machine  1  sending  sign)  the  message  “D3”  to  machine  2.  “Initial_state  1  1 
1”  means  that  the  initial  states  of  machine  1,  machine  2,  and  machine  3  are  state  1. 


Stan 

numbcr_of_machines  3 
machine  I 
state  1 

trans  -D3  3  2 
trans  -DO  2  2 
state  2 

uans  +D2  1  3 
machine  2 
state  1 

trans  +D3  3  1 
trans  +D0  2  1 
state  2 

trans  -D1  1  3 
machine  3 
state  1 

trans  -fD2  2  2 
state  2 
uans  -D4  3  1 
trans  -D2  1  1 
initiaLsiate  I  I  1 
finish 

Figure  10:  Text  file  description  of  the  FSM 


First,  this  file  is  parsed  by  read_in_file  procedure  and  tokens  are  generated.  Then, 
Load_machine_array  procedure  constructs  an  adjacency  list  which  represents  the  FSMs. 
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The  data  structure  for  the  adjacency  list  is  shown  below: 


type  cfsm_transition_type  is  (s/.u); 
type  visit_type  is  (yes,no); 
type  state_type  is  range  0..S0; 
type  next_machine_type  is  range  1..8; 
type  machine_aiTay_record_type: 
type  Slink.tupe  is  access  machine_anay_tecord_type; 
type  machine_array_recoRl_type  is 
record 

transition  :  cfsm_transition_type  :=  u; 

message  :  niessage_queue.message_queue_type; 

next.Mstate  :  state.type  :=  0; 

other_machine  :  next_machine_type  :=  1; 

visited  :  visit_type  :=  no; 

Slink  ;  Slink_type  ;=  null; 

end  record; 

type  machine_array_type  is  array(staie_type  range  0..S0)  of  Slink.type; 

type  system_array_type  is  array(next_machine_type  range  1..8)  of  machine_array_type; 

The  adjacency  list  for  the  example  protocol  is  depicted  in  Figure  12.  This  adjacency 
list  is  used  for  constructing  the  global  reachability  graph.  The  adjacency  list  contains  all  the 
necessary  information  for  generating  the  global  reachability  graph. 

The  user  also  provides  the  name  of  the  text  input  file  and  a  file  name  for  storing  the 
analysis  results.  Input  file  name  must  end  with  *‘.fsm'’  extension  to  prevent  confusion.  The 
output  file  name  must  be  no  more  than  20  characters  long. 


C.  REACHABILITY  ANALYSIS 

After  reading  the  input  file  the  program  starts  generating  the  global  reachability  graph. 
The  program  uses  the  adjacency  list  and  the  initial  state  to  construct  the  global  reachability 
graph.  Starting  with  the  initial  state,  the  new  states  are  added  and  linked  to  the  graph 
dynamically.  The  algorithm  to  construct  the  global  reachability  graph  is  given  in  Figure  13. 

During  the  graph  construction,  the  program  also  detects  the  global  states  with 
deadlocks  and  unspecified  receptions.  The  program  also  finds  the  maximum  message 
queue  size  and  channel  overflows.  Analysis  results  are  stored  in  the  output  file  in  parallel 
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with  the  graph  construction.  This  prevents  the  traversal  of  the  entire  graph  one  more  time 
at  the  end  of  the  program  and  decreases  the  run  time. 


loop  (main  loop) 

for  index!  in!  ..  total juunberjjfjnachines  loop 
place  Ju>lder(indexl) machine_array(indexl )  (M_state(indexl )) 
while  ( place _holder( index)  /s  null)  loop 
loop 

if  ( /dace _holder( indexi ).  transition  =  s)  then 
Enqueue  the  message  into  the  corresponding  message  queue 
search  the  graph  for  this  new  global  state  tuple 
if  not  found  then  create  a  new  node  and  link  to  the  graph 
Enqueue  this  new  node  to  the  pointer _queue 
else  link  the  transition  to  found  global  state  tuple 
else 

if(place_holder(indexl).transition)  =  r  and  at  least  one  of  the  message  queues  for 
this  machine  is  not  enqjty  then 
find  this  message  queue  and  Dequeue 
search  the  graph  for  this  new  global  state  tuple 
^  not  found  then  create  a  new  node  and  link  to  the  graph 
Enqueue  this  new  node  to  the  pointer _queue 
else  link  the  transition  to  found  global  state  tuple 
end  if  : 

place _holder( index! )  :=  place_holder(index! ).Slink 
exit 

end  loop 
end  loop 
end  loop 

if  pointer  queue  empty  then 
exit 
else 

Dequeue  pointer _queue  and  update  M_state  for  this  new  node 
end  if 

end  loop  (main  loop) 

Figure  13:  Algorithm  for  generating  global  reachability  graph  for  CFSM 


One  of  the  most  time  consuming  procedures  is  the  search  algorithm  for  detecting  if  a 
node  was  previously  created.  The  previous  version  of  the  program  [Ref.  8]  used  a  depth 
first  search  /  breadth  first  search  in  a  recursive  manner.  In  this  program,  the  search  is  made 
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more  efficient  using  a  hashing  algorithm.  The  hash  function  is  obtained  from  the  machine 
states  of  the  global  tuple  which  has  provided  an  efficient  mapping.  Therefore,  the 
complexity  of  the  search  algorithm  is  0(1)  when  the  hash  function  generates  a  distinct 
index  (no  collision)  and  0(n)  when  the  same  index  is  generated,  where  n  is  the  number  of 
hash  collisions  for  that  state.  In  many  sample  runs  of  the  program,  the  complexity  was  0(1) 
for  about  30%  of  the  global  states,  and  3  nodes  had  to  be  traversed  on  the  average  for  70% 
of  the  global  states.  The  reachability  analysis  is  limited  by  the  storage  capacity  of  the 
computer.  The  run  time  is  also  another  factor  that  must  be  considered.  The  largest  analysis 
carried  out  by  the  program  thus  far  has  generated  about  160,000  states  in  12  hours  for  a  six 
machine  protocol  specification.  Some  alternative  methods  for  improving  the  efficiency  of 
the  program  and  analysis  size  using  other  search  techniques  are  discussed  in  Chapter  VI. 

The  structure  of  a  global  node  is  shown  in  Figure  14.  The  maximum  number  of 
outgoing  transitions  is  limited  to  7,  which  can  be  increased  if  needed.  Also,  a  maximum 
channel  capacity  of  6  messages  is  introduced  to  ensure  that  the  analysis  eventually  stops. 

D.  OUTPUT 

The  program  stores  the  analysis  results  in  a  file  named  by  the  user  during  the 
reachability  graph  construction.  This  file  contains  the  specification  in  a  tabular  fonnat, 
reachability  graph  and  the  results  of  the  analysis  consisting  of  the  number  of  states 
generated,  number  of  states  analyzed,  number  of  deadlocks,  number  of  unspecified 
receptions,  maximum  message  queue  size  and  number  of  channel  overflows.  Global  states 
with  deadlocks  and  unspecified  receptions  are  also  marked  in  the  reachability  graph.  The 
output  file  also  lists  the  unexecuted  transitions.  A  menu  is  displayed  at  the  end  of  the 
analysis.  From  this  menu  the  user  has  the  option  of  displaying  or  printing  the  results  or 
continuing  the  program  for  another  analysis. 


25 


If  the  analysis  generates  more  than  2000  states,  the  program  gives  an  interim  summary 
of  the  analysis  and  asks  the  user  if  they  would  like  to  continue.  If  the  user  wishes  to 
continue,  analysis  proceeds  in  steps  of  1000  states  until  the  analysis  ends  or  the  user 
terminates  the  analysis  (as  long  as  memory  is  available).  For  analyzing  large  protocols,  the 
number  of  states  between  these  “stops”  can  be  made  larger  (for  example,  increments  of 
SOOO  or  10000).  The  program  output  for  the  example  protocol  in  Chapter  II  is  given  in 
Figure  15. 
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Figure  15:  Program  output  for  the  example  ring  protocol 
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IV.  SMART  AND  BIG  MUSHROOM:  A  PROGRAM  FOR  AUTOMATING  SCM 

REACHABILITY  ANALYSIS 


In  this  Chapter,  programs  that  automate  either  system  state  analysis  (smart 
mushroom),  or  the  full  global  analysis  (big  mushroom)  for  a  protocol  specified  by  SCM 
are  described.  The  program  is  described  in  four  sections;  general  program  structure,  inputs 
to  the  program,  generating  the  reachability  graph,  and  outputs  of  the  program. 

A.  PROGRAM  STRUCTURE 

Program  structure  of  Smart  Mushroom  and  Big  Mushroom  are  similar  to  the  structure 
of  Simple  Mushroom.  The  SCM  model  specification  is  more  complicated  than  the  CFSM 
specification,  but  this  complexity  in  the  specification  brings  some  advantages  to  the 
analysis  as  mentioned  in  Chapter  II.  A  protocol  specified  by  the  SCM  model  consists  of 
FSMs,  variable  definitions,  and  predicate-action  table,  rather  than  just  the  FSMs  as  in 
CFSM  model. 

FSMs  are  entered  into  the  program  in  the  same  manner  as  in  Simple  Mushroom 
program  using  a  text  file.  The  variable  definitions  and  predicate-action  table  must  also  be 

entered  into  the  program.  The  user  enters  these  pans  by  completing  Ada  packages^  and 
subprograms  using  the  templates  provided. 

The  compilation  units  for  the  program  are  shown  in  Table  3.  The  user  has  access  to  the 
last  four  packages/subprograms.  Once  the  user  completes  these  subprograms  using  the 
templates  and  compiles  them  with  the  other  compilation  units,  the  analysis  of  the  specified 

1 .  Ada  packages  are  one  of  (he  four  forms  of  program  unit,  of  which  programs  can  be  composed. 

The  other  forms  are  subprograms,  task  units,  and  generic  units.  Packages  allow  the  qiecificalion  of 
groups  of  logically  related  entities.  In  their  simplest  form  packages  specify  pools  of  common  object 
and  type  declarations.  [Ref.  131 
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protocol  can  be  performed.  Construction  of  the  specification  in  the  form  of  Ada  packages 
and  subprograms  is  explained  in  the  next  section. 


TABLE  3;  SMART  AND  BIG  MUSHROOM  PROGRAM  COMPILATION  UNITS 


Compilation  Unit 

Description 

File  name 

Main  (procedure) 

This  is  the  parent  unit.  Contains  the 
main  data  structures,  global  vari¬ 
ables,  and  the  driver. 

smain.a 

load_machine_array 

(procedure) 

Builds  the  adjacency  lists  from 
FSMs. 

sinputa 

read_in_file  (procedure) 

Parses  the  input  FSM  text  file. 

sinput.a 

build_Gstate  _graph 
(procedure) 

Generates  the  global  reachability 
graph. 

sg_reachability.a 

build_system_state_graph 

(procedure) 

Generates  the  system  reachability 
graph. 

sg_reachability.a 

hash  (function) 

Generates  an  index  number 
according  to  the  hashing  function. 

sg_reachability.a 

clear_pointers  (procedure) 

Deallocates  the  dynamic  memory 
space  for  another  analysis. 

sg_reachability.a 

scarch_for_Gtuple 

(function) 

Searches  the  reachability  graph 
for  the  equivalent  global  tuples 
using  hashing. 

sg_search.a 

clear_hash_array 

(procedure) 

Clears  the  hash  array  and  deallocates 
the  memory  for  global  reachability 
analysis. 

sg_search.a 

search_for_Stuple 

(function) 

Searchs  the  reachability  graph 
for  the  equivalent  system  tuples 
using  hashing. 

sg_search.a 

clcar_hs_hash_array 

(procedure) 

clears  the  hash  array  and  deallocates 
the  memory  for  system  state 
analysis. 

sg_search.a 

output_Gstatc_node 

(procedure) 

Outputs  the  machine  states,  and 
states  with  deadlock  for  global 
reachability  analysis. 

sg_output.a 
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Compilation  Unit 

Description 

File  Name 

output_sys_node 

(procedure) 

Outputs  machine  states,  and 
states  with  deadlock  for  system 
state  analysis. 

sg_output.a 

output_Gstate_transition 

(procedure) 

Outputs  the  transition  name  for 
global  reachability  analysis. 

sg_output.a 

output_sys_transition 

(procedure) 

Outputs  the  transition  name  for 
system  state  analysis. 

sg_output.a 

output_unexecuted_transi- 
tions  (procedure) 

Outputs  the  unexecuted  transitions. 

sg_output.a 

output_machine_arrays 

(procedure) 

Outputs  the  FSM  description  in 
a  tabular  format. 

sg_output.a 

output_analysis 

(procedure) 

Driver  for  the  output  subprograms. 

sg_output.a 

system_call  (procedure) 

Interface  program  for  Unix 
system  calls  via  C. 

ssystem.a 

queues  (generic  package) 

Implements  the  queue  operations 
for  the  pointer  queue  that  stores 
the  nodes  temporarily. 

squeues.a 

stacks  (generic  package) 

Implements  the  stack  operations 
for  storing  enabled  transitions. 

sstacks.a 

definitions  (package) 

Includes  user  defined  local  and 
shared  variables. 

named  by  the 
user 

Analyze_Predicates 
(procedure)  there  is  one 
for  each  machine 

Determines  the  enabled  transitions 
from  the  predicates. 

named  by  the 
user 

Action  (procedure) 

Executes  the  actions  for  the 
enabled  transitions. 

named  by  the 
user 

output_gtuple  (procedure) 

Outputs  the  global  state  tuples  in 
a  format  defined  by  the  user. 

named  by  the 
user 

1 
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B.  INPUT 

The  inputs  to  the  program  consists  of  three  parts,  as  mentioned  earlier.  FSMs  are 
entered  using  a  text  file  representation  as  in  Simple  Mushroom  program.  Variables  and 
predicate-action  table  are  entered  as  Ada  packages/subprograms.  The  user  needs  to 
complete  these  packages  and  subprograms  by  filling  in  templates  provided. 

The  Ada  package  template  for  the  variable  declarations  is  called  “definitions.”  Hie 
predicate-action  table  is  entered  using  an  Ada  subprogram  template  which  consists  of  one 
procedure  named  “Action”  and  two  to  eight  procedures  called 
“Analyze_Predicates_Machine*”  according  to  the  number  of  machines  in  the  protocol. 
The  “*”  at  the  end  of  the  procedure  name  is  replaced  by  the  corresponding  machine  number 
for  each  machine  in  the  protocol. 

After  completing  the  templates  described  above,  the  user  must  compile  these  units 
with  the  other  compilation  units  listed  in  Table  3.  The  program  units  can  be  compiled  by 
entering  a  “make”  command.  The  “make”  command  executes  a  list  of  shell  commands  in 
the  “Makefile”  file  which  contains  the  commands  for  compiling  the  program  units 
according  to  their  dependencies.  After  issuing  the  “make”  command,  the  executable  file  is 
stored  in  a  file  named  “scm.”  The  “Makefile”  is  provided  to  the  user  with  the  mushroom 
program. 

Each  of  these  program  units  will  be  explained  in  the  following  subsections.  The 
example  ring  protocol  described  in  Chapter  II  is  also  used  to  illustrate  how  to  complete  the 
templates. 

1.  Finite  State  Machines 

There  are  a  few  differences  in  the  FSM  description  of  Smart  and  Big  Mushroom 
programs  from  Simple  Mushroom  program.  The  same  reserved  words  are  used  to  write  the 
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FSM  text  file.  These  are  listed  in  Figure  9.  The  syntax  changes  that  must  be  made  to  this 
form  are  shown  in  Figure  16. 

In  the  SCM  model,  explicit  machine  numbers  to  show  which  machine  the 
message  sent  to  or  received  from  are  not  needed  for  the  transition  names.  Since  shared 
variables  are  used  for  communication  between  machines,  this  information  is  included  in  the 
predicate-action  table.  The  FSM  text  file  for  the  example  ring  protocol  is  shown  in  Figure 
17. 

trans  <transition  name>  <next_state> 

<transition  name>  <identifier> 

<identifier>  ::=  ([underline]  I  letter_or_digit} 

<letter_or_digit>  ::=  <letter  >  I  <digit> 

Figure  16:  Syntax  changes  for  FSM  description  of  SCM  model 


start 

nuinbcr_of_niachincs  3 
machine  1 
state  0 

trans  snd.datal  I 
state  I 

trans  rcv_data3  0 
machine  2 
state  0 

trans  rcv_datal  1 
state  1 

trans  snd_data2  0 
machine  3 
state  0 

uans  rcv_data2  1 
state  1 

trans  snd_data3  0 
initial.state  000 
finish 

Figure  17:  Text  file  description  of  the  example  ring  protocol 
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The  FSM  text  file  is  read  by  the  input  procedures  and  the  adjacency  list,  which  is 
used  during  the  construction  of  system  and  global  reachability  graphs  is  generated.  The  data 
structure  for  the  adjacency  list  is  shown  in  Figure  18. 


visit_type  is  (yes,  no); 

type  machine_aiTay_recofd_type: 
type  Slink.type  is  access  inachine_anay_rcconl_type; 
type  machine_aiTay_feconl_type  is 
record 

transition  :  scm_iransition_type  ;=  unused; 

next.Mstate  :  natural  :=  0; 

visited  :  visit_type  :=  no; 

Slink  ;  Slink_type  :=  null; 

end  record; 

type  machine_array_type  is  aiTay(integer  range  0 ..  50)  of  Slink_type; 

type  systefn_aiTay_type  is  array  (1 .,  num_of_machine)  of  n[>achine_arTay_type; 

Figure  18:  Data  structure  for  the  adjacency  list. 


2.  Variable  Definitions 

The  user  defines  the  protocol  variables  in  an  Ada  package  named  drfinitions.  This 
package  includes  the  local  variables  for  each  machine  and  the  global  variables,  which  are 
considered  shared  and  allow  c.'mmunication  between  machines.  A  variable  can  be  one  of 
the  Ada  defined  types  such  as:  integer,  array,  string,  record,  character,  boolean,  etc.  These 
types  and  their  subtypes  are  used  to  define  the  protocol  variables. 

The  template  for  the  drfinitions  package  is  given  in  Figure  19.  The  shaded  areas 
show  where  the  variables  of  the  protocol  are  inserted  by  the  user.  Additional  type 
declarations  should  be  placed  before  the  machine  type  declarations. 

The  variable  declarations  for  the  example  ring  protocol  is  also  shown  in  Figure 
20.  The  local  variables  of  the  protocol  are:  in_buffl,  in_bufr2,  in_buff3,  out_bufn, 
out_buff2,  and  out_buff3.  The  shared  variables  are:  CHANl,  CHAN2  and  CHAN3.  The 
type  definition.  Dummy  type  is  placed  in  each  of  the  local  variable  declarations  of 
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machines  in  case  the  protocol  has  less  than  eight  machines.  When  declaring  the  local 
variables  for  each  machine,  this  dummy  variable  can  be  deleted  from  the  corresponding 
machine.  The  initial  values  of  the  variables  are  also  assigned  with  the  variable  declarations. 


with  TEXTJO; 
uscTEXTJO; 
package  definitions  is 
num.of.inachines :  constant  := 
type  scm_transition_type  is  ( 
type  dummy_type  is  range  1..255; 


Nmbcr  or  MMklM*  hi  the  apcdflcallMi 
'  (cm  be  2  to  S) 


): 


type  machinel.state.type  is  TraMtiion  ommi  or  fsms 

record 

dummy ;  dummy.type; 


type  global_variable_type  is 
record 


end  record; 
end  definitions; 


Globai  (Aartd)  variaMci 


Figure  19:  Template  for  definitions  package 


3.  Predicate-Action  Table 

The  predicate-action  table  is  represented  by  a  number  of  subprograms  as  separate 
compilation  units.  These  subprograms  are  named  Analyze  Predicates  and  are  used  to 
determine  the  enabled  transitions  for  each  machine.  The  procedure  named  Action  executes 
the  actions  to  be  taken  for  the  corresponding  enabled  predicates.  There  is  one 
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Anafyze_Predicates  procedure  for  each  machine  and  one  Action  procedure  fw  the  protocol. 
The  template  for  the  Analyze  J*re<Ucates  procedure  is  shown  in  Figure  21. 


withTEXTJO; 
use  TEXTJO; 
package  definitions  is 

nun)_of_machines :  constant  :s  3; 

type  scm_tiansition_type  is  (snd_datal^cv_data3,siid  jdatal, 

rcv_datal,SBd_data34vvjdata2,unused); 

type  buffer  type  is(D,E); 

package  bu7f_enuin_k)  is  new  enunieratiQn_io  (buffer_type); 

use  bufr_enuin_io; 

type  dufiTmy.ty^  is  range  1..2SS: 

type  machinel_state_type  is 
record 

out_bufn  :  buffer_type  :=  D; 
in_bufn :  bufrer_type:=  E; 
end  record; 

type  machine2_state_type  is 
record 
out_buff2, 

in_bufr2  :  bufrer_type:=  E; 
end  r^ord; 

type  machine3.state_type  is 
record 

out_bun3, 

in_buff3  :  buffer^type  :=  E; 
end  rword; 

type  niachine4_state_type  is 
record 

dummy :  dummy_type; 
end  record; 


type  machine8_state_type  is 
record 

dummy :  dummy.type; 
end  recoim; 

type  globai_variable_type  is 
record 
CHAM, 

CHAN2, 

CHAN3  :  bufTer_type  :=  E; 
end  record; 

end  definitions; 


Figure  20;  Completed  Definitions  package  for  the  example  ring  protocol 
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separate(inain) 

pnx%dure  Analyze_Predicates_machinelGocal :  machiiiel.staie.type; 

global :  global.wiablejiype; 
s:  natural; 

w :  in  out  lransition_stack_|iackage.siack)  is 

begin 


when  others  -> 


null; 
end  case; 

end  Analyze.Piedicates.machinel; 


Figure  21:  Template  for  Analyze  Predicates  procedures 


The  user  completes  the  template  for  each  state  of  the  machines.  For  each  machine 
state  there  is  one  “when”  statement.  “If’  sutements  specify  the  predicates  for  possible 
transitions  from  the  current  state.  The  “Push”  statement  stores  these  transitions  in  the  stack. 
Since  more  than  one  transition  can  be  enabled  in  some  states,  a  stack  is  used  to  stme  all 
possible  transitions.  The  “s”  parameter,  in  the  formal  parameter  list  of  the  procedure,  passes 
the  machine  state;  and  the  “w”  parameter  passes  the  stack  name  to  the  procedure.  The  file 
for  the  example  ring  protocol  is  given  in  Figure  22. 

The  template  for  the  Action  procedure  is  shown  in  Figure  23.  The  enabled 
transitions  are  passed  into  this  procedure  through  the  “in_transition”  formal  parameter  and 
the  necessary  changes  are  made  to  the  local  and  shared  variables  by  the  Action  procedure. 
The  “out_system_state”  parameter  passes  the  changed  protocol  variables  to  the  calling 
procedure.  The  completed  A  cn'on  procedure  is  shown  in  Figure  24.  Text  in  boldface  shows 
the  user  defined  parts. 
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Mpaiale  (main) 

piooeduR  Aniilyze_PiedicMef_Maciiinel(local  :nMGliinel_fiau:_type;  GLOBAL:  flotel.vaiiaUe.Qrpe; 

t :  natunl;  w  :  in  oaii]mtibon_flack_paduge.iiack)u 

begin 

cawtit 

i«kM0=> 

if((GLOBAL.CHANl  =  E)  and  ( LOCAL^.bnffl  t=  E)  )dien 
Puili(w,flid_datal); 
end  if; 

if(GLOBAL.CHAN3/-E)  then 
l\iih(wjrcv_daU3); 
end  if; 

whenaihefts> 

null; 

endcaie; 

end  Anatyze_Piedicaie(_Maciiine  I ; 
sepaiaie  (main) 

prooedure  Analyae_Piedicaiei_MacMne2(local :  maciiine2_iUie_type;  GLOBAL:  glabal_variBble_iype; 

i:  natural;  w  :  in  out  tiantition_itaGk_padkage.iiacl()  it 

begin 
cate  til 
wImm  0  s> 

if  (GLOBAL.CHAN1  /=  E)  then 
Piiih(w,rcv_dalal); 
end  if; 

1 

if  (  (gLoBAL.CHAN2  =  E)  and  (locaLout_bn(R  /=  E)  )  then 
^th(w^d_data2); 
end  if; 

whcnatheft=> 
null; 
end  cate; 

end  Analyze_Piedicatet_Machine2; 
teparate  (main) 

prooedufe  Analyte_IVedicatei_Machine3(local :  machine3_ttate_type;  GLOBAL:  globol_vaiiable.type; 

I :  natural;  w :  in  out  tmntition_itaclc_pacfcage.atack)  it 

begin 

catetit 

t>hcnOs> 

if  (  GLOBAL.CHAN2  /=  E )  then 
puth(w,rev_daU2); 
end  if; 
when  1  => 

if  (  (GLOBAL.CHAN3  =  E  )  and  (localMt_bun3  /=  E  )  )  then 
(Mih(w,ind_data3); 
end  if; 

whcnolhen=> 
null; 
end  cate; 

end  Alialyze_PRdicates_Machine3; 
tepaiate  (main) 

procedure  Analys_Piedicatet_Machine4(local  inachine4_iutejly|ie;  GLOBAL:  global.vaiiaUe.lype; 

I :  natural;  w :  in  out  tianiNion_itack_pad(age.ilack)  it 

begin 

null; 

end  Analyze_Piedicatei_Machine4: 


teparate  (main) 

procedure  Anatys_Ptedicatei_Machine8(local :  machine8_tute_type;.  GLOBAL:  glabal_variabte_type; 

I :  nauiral;  w  :  in  out  iraniition_ttack_pa^ge.ita«dc)  it 

begin 

null; 

end  Analyze_Piedicatet_M*chine8; 


Figure  22:  Completed  Analyze _Pre(Ucates  procedures  for  the  example  ring  protocol 
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fqwnie(inaiii) 

ptoceduie  Actimi  ( iii_tyMeni_fUie  ;  in  out  Otmte.ieconl.iype: 

■n.tmniian  :  in  out  ieni_lnnfiiion_iype; 
oiii_fy«efn_fUie ;  in  out  GsiMe_noonl_9pe  )  it 


whenaihens> 

puiCEnor  in  Ihe  aaion  piDoeduie'*); 
Old  cue; 
end  Action; 


Figure  23;  Template  for  Action  procedure 


lepanle  (main) 

procedure  Aclian(in_tytlan_flaie  :  in  outG<Ute_iecofd_type;  in_lnntilian  :  in  out  tcm_lraitilian_lype; 
out_tyiiem_tuie  :  in  out  Gtuie.recaid.iype)  it 

begin 

cate  (in  tmtilian)it 

when  (Md.tfaUl)  »  0Mt_a]PaiCM_atidc.GLOBAL_VARIABLES.CHANl:= 
ln_iyilein_etate.nmcMticl_tt»t»,«nt_bu<Tl; 
out_q'ttf  _ttatejnaeMncl_Wate.eMt_l>Wfl  :x  E; 

when  (rev  dala3)  3>  ent  tjMm  aUtejnncMncl  etntr  in  bnffl  :s 

~  ta_f)f^_ftirtcjGLOBAL.VAklABLES.CHAN3; 

OMt  ayaicM  atalcjnnchhwl  rtaieent  bnffl  :soM  qrtuin  UntejnncMnel  Unlt.bi  baffl; 
0«rt]ratcniltUlc.GLOBAirVARUiLES.CHAN3:xE;  ~ 

when  (Md_data2)  =>  o«l_ayatcM_alaUA:LOBAL_VARIABLiS.CHAN2:= 
iii_ayil^_t>t>*,iiincMn«2_itoteiewt_hnin; 
e«(_t^ile«_aUitcJMChhM2_tUlc4Wt_b«fR  :s  E; 

when  (rev  datal)  =>  out  lyttem  e>at>.inechinc2  aUteJn  btrfR  := 

~ln_a]ra(cm_iU<cX:LOML_VARUBLES.CHANl; 
out  tyalcM  atataaMchlnd  iUtc.aut  b«rfR:ra«t  itatejnnchlne2  itnlr.hi  buR; 

e«rtyttcM~tUicX:LOBAl7  VARIABLE&CHANl  :rE;  ~ 

whcn(Md_daU3)  »>  o«l_ar«eM_tUtc.GLOBAL_VARUBLES.CHAN3;3 
hi_tyRiein_HnH.f  chiiie3_H»te^_holf3; 
owt_iyiteni_Riit,nchlin3_tlrte^t_biiiP  :=  E; 

when  (rev  daU2)  =>  out  ijratem  ■tete.iw>clilne3  tUieJn  bulD  :x 

~hi_a7^_atalc.GLOBAL_VARUBLES.CHAN2: 
out  ajraieui  iiatcjuachluo3  itatc.out  bufD  :s  out  ayitaui  ttotoj— c»lue3  atalcJu  hulD; 
ourt]ratcurttatc.GLOBAirVARIABLES.CHAN2:3E;  ~ 

when  oiheri  =>  putJineCThere  it  an  error  in  the  Action  procedure''); 
end  cate; 
end  Action; 


Figure  24:  Completed  Action  procedure  for  the  example  protocol 
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C.  REACHABILITY  ANALYSIS 


The  process  of  generating  the  set  of  all  states  reachable  from  the  initial  state  is  called 
reachability  analysis.  The  program  is  capable  of  generating  both  the  global  and  system 
reachability  analyses  separately  for  a  protocol  specified  formally  by  the  SCM  model. 

The  user  selects  either  global  reachability  analysis  or  system  state  analysis  from  a 
menu.  During  the  graph  construction,  the  program  also  detects  the  states  with  deadlock 
condition.  Analysis  results  are  stored  in  the  output  file  named  “rgraph.dat”  in  parallel  with 
the  graph  construction. 

Generating  the  global  reachability  analysis  and  system  state  analysis  will  be  described 
in  the  following  subsections. 

1.  Global  Reachability  Analysis 

The  structure  of  the  global  node  representation  used  for  the  program  is  shown  in 
Figure  25.  This  node  structure  also  includes  the  outgoing  transitions.  The  maximum 
number  of  outgoing  transitions  is  limited  to  7,  which  can  be  increased  if  necessary.  The 
shared  variables  are  stored  in  the  global  varieties  variable  and  local  variables  are  stored 
separately  for  each  machine  in  the  machine  state*  variables. 

The  initial  global  state  is  constructed  from  both  the  FSM  text  file  and  the  initial 
values  of  the  variables  assigned  in  the  definitions  package.  All  the  outgoing  transitions  are 
set  to  nu//  initially.  Starting  with  the  initial  global  state,  new  nodes  are  added  and  linked  to 
the  graph.  The  algorithm  for  generating  the  global  reachability  graph  is  the  same  as  the 
algorithm  given  for  the  system  state  analysis  in  Chapter  II  except  that  the  “system  states” 
must  be  replaced  by  “global  states.”  Figure  26  shows  a  pseudo-code  algorithm  to  construct 
the  global  reachability  graph. 
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Figure  25:  Global  state  structure  with  outgoing  transitions 

The  program  uses  hashing  for  searching  the  reachability  graph  which  increases 
the  run  time  efficiency  of  the  program.  The  reachability  analysis  is  limited  by  die  storage 
capacity  of  the  computer  and  by  the  run  time  as  in  Simple  Mushroom  program.  For 
example,  the  program  generated  31,460  global  states  for  a  sliding  window  protocol  of  two 
machines  defined  in  [Ref.  1]  for  a  window  size  of  10.  The  run  time  for  this  example  was 
about  10  minutes.  The  number  of  states  and  the  run  time  increases  greatly  as  die  number  of 
machines  in  the  protocol  increases  and  the  protocol  speciHcations  become  larger. 
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loop  (main  loop) 

for  index!  in!  ..  mal_number_pfjnachines  loop 
position  JioUkiiindexI) maMne_array(indexl)  (M_staie(indexl)) 

Determine  the  enabled  transitions  for  the  machine(indexl)  and  push  into  transition_stack 
While  not  Empty(transition_stack)  loop 
while  (position_holder(indexI)  /-  nidi)  loop 
Traverse  the  machine  arrays  for  each  enabled  transition  in  the  stack 

^  a  transition  found  in  the  machine  arrays  create  a  temporary  node  resultingfrom  this  transition 
call  Action  procedure  to  make  the  necessary  changes  to  the  variables  of  this  node 
Search  the  graph  for  this  node 
fa  node  not  found  then 
insert  and  link  the  node  to  the  graph 
Enqueue  the  node  into  the  Gpointer_queue 
else 

link  the  node  to  the  graph 
end  if 
else 

position_holder(indexI )  position_holder(Uidexl )Slink 

end  if 
end  loop 

if  not  Empty!  transition  _stack)  and  a  transition  not  found  in  the  machine  arrays 
pop  the  stack 
end  if  ; 
end  loop 
end  loop 

if  Gpointerjqueue  Empty  then 
exit 
else 

Dequeue  Gpointerjqueue 
Update  M_state  for  this  new  node 
endf 

end  loop  (main  loop) 

Figure  26;  Algorithm  for  generating  global  reachability  graph  for  Big  Mushroom 


2.  System  State  Analysis 

The  steps  in  constructing  the  system  state  graph  are  detailed  in  Chapter  II.  The 
structure  of  a  system  state  is  shown  in  Figure  27.  Since  the  variables  are  not  part  of  the 
system  state,  system  state  nodes  are  much  smaller  than  the  global  state  nodes.  However,  in 
order  to  determine  the  enabled  transitions,  variables  are  still  needed  for  each  node  in  the 
graph.  The  program  stores  the  variables  in  secondary  storage,  instead  of  keeping  them  as  a 
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pan  of  the  node,  which  decreases  the  amount  of  primary  memory  used  and  allows  the 
analysis  of  larger  and  more  complex  protocols. 

The  pseudo-code  algorithm  for  constructing  the  system  reachability  graph  is 
shown  in  Figure  28. 


1  S3«tem_state_Bumber 

_ 1 

STUPLE 

aiachiM_state 

1 

22 

4 

5  6' 

1  8 

subscript 

LINK 

1 

StrausitioD 

Syslink 

2 

• 

« 

7 

Figure  27:  System  state  structure  for  Smart  Mushroom  program 

D.  OUTPUT 

The  program  stores  the  results  of  the  analysis  in  a  file  named  “rgraph.dat.”  This  file 
contains  FSMs  in  a  tabular  format,  system/global  reachability  graph,  and  the  results  of  the 
analysis  consisting  of  number  of  states  generated,  number  of  states  analyzed,  and  number 
of  deadlocks.  Unexecuted  transitions  are  also  listed  at  the  end  of  the  analysis. 

Since  each  protocol  specification  has  different  variables,  the  user  also  has  the 
flexibility  to  output  the  desired  variables.  This  is  done  in  a  similar  manner  to  the  predicate- 
action  table  and  variable  definitions  representation  explained  earlier  using  an  Ada 
procedure  template.  The  template  for  the  OutputjGtuple  procedure  is  shown  in  Figure  29. 
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The  user  completes  the  template  with  Ada  “put”  statements  for  outputting  the  global  states. 
Since  the  system  state  tuples  do  not  include  the  variables,  there  is  no  need  to  define  an 
output  format  for  system  reachability  graph. 

loop  (main  loop) 

for  index!  in  !..  numjafjrans  loop 
if  parent_Sstate.link(indexl  ).Stransition  unused  then 

for  index2  in  1 ..  total _num_ofjnachines  loop 
posiotionjiolder  ;=  machiMjarray(iHdex2)  (M_state(index2)) 
while  positionjiolder  /=  null  loop 

if  poMwnJtolder. transition  -  parent_Sstate.link(indexl  ).Stransition  then 
create  alemporary  system  state  and  store  the  corresponding  variables 
determine  the  enabled  outgoing  transitions 
search  the  system  state  grt^th  for  this  node 
if  node  not  found  then 
insert  the  node  and  link  to  the  graph 
Enqueue  the  node  into  sys _pointer_queue 
else 

link  the  node  to  the  graph 
end  if 
exit 
else 

positionjiolder  :=  positionjiolder. Slink 
end  if 
end  loop 

if  an  enabled  transition  found  in  the  machine  arrays  then 
exit 
end  if 
end  loop 
else 
exit 
end  if 
end  loop 

if  sys  jMinter  queue  empty  then 
exit 
else 

Dequeue  the  sys _pointer_queue 
update  M_state 
endtf 

end  loop  (main  loop) 

Figure  28:  Algorithm  for  generating  system  state  graph  for  Smart  Mushroom  program 


The  completed  template  for  the  output  Gtuple  procedure  is  also  given  in  Figure  30. 
As  in  Single  Mushroom  program,  if  the  analysis  generates  more  than  2000  states,  the 
program  gives  an  interim  summary  and  continues  in  steps  as  described  in  Chapter  III.  At 
the  end  of  the  program,  the  user  can  display^irint  the  results  or  continue  with  another 
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system/global  state  analysis  selecting  the  desired  options  from  the  menu.  The  output  of  the 
program  for  the  example  ring  protocol  is  given  in  Figures  31  and  32. 


sqMuate  (main) 

procedure  output_Guiple  (tuple :  in  out  Gstate_record_type)  is 
begin 

if  print_header  then 
new  Iinc(2)^ 

set_col(S):  '  header  fomuit  for  the  variaMes 


print.header  false; 
else 

putCT*  &  inieger’image  (tuple.machine_state  (1)) ); 
put(“.“): 


machine  1  local  variables 


put(*‘[“  &  integer'image  (tuplc.machine_staie  (2)) ); 
put(“.“); 


put(‘T‘  &  integer’image  (tuple.machine  state  (8)) ); 
put(“.“); 

||||[|mi||||H|^_^  global  variables 


end  if; 

end  output.Gtuple; 

Figure  29;  Template  for  ouiput  Gtuple  procedure 
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separate  (main) 

procedure  ouq>ut_Guiple(Uiple :  in  out  Gstate_fecord_type)  is 
begin 

if  print.header  then 
ncw_line(2); 
set_col(5); 

put  linc(*'  ml(in  bufn,oat_bufn),m2(in_buff2^t_bufR)jii3(iii_bufl3,out_bufr3), 
(CHANI,CHAN2,CHAN3)”); 
print.header false: 
else 

putC*  ["  &  inieger‘iinage(tuple.machine_siate(l))  ): 
putC‘.“); 

buff  enum  io.put(tuplejnachinel_state.in_bafn); 
pul(=,«);  ■ 

bufT_enum_io.put(tuple.machinel_state.out_ba(fl); 
putT  &  integer'image(tuple.machine_state(2))  ); 

putC‘.“); 

buff  enum  io.|>ut(tuple.machine2_state.in_bun2); 
puK-,-);" 

buff'_cnum_io.put(tupie.machine2_state^t_bufn); 
put(“ ,  “); 

put(integer'image(tuple.machine_state(3)) ): 
put(«.“); 

buff  enum  io.put(tuplejnachine3_state.in_bufl3); 

puK“,“);  " 

buff  enum  io.put(tuplejnacfaine3  state.out_bufK3); 

puK“,“);~ 

buff  enum  io.put(tuple.GLOBAL  VARIABLES.CHAN1); 
putf^,**);  " 

buff  enum  io.put(tuple.GLOBAL_VARIABLES.CHAN2); 
put(“,“);" 

buff  enum  io.put(tuple.GLOBAL_VARIABLES.CHAN3); 

put(=r);  " 

end  if; 

end  output.Gtuirie: 

Figure  30:  Completed  outpiu_Gtuple  procedure  for  the  example  protocol 
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KBJkOUBZLZrX  MULTSXS  »C  iriag.aoa 
nwczrzcnTXOii 


lUohIfia  1  Stata  Traaaltloaa 


rre«  I  To  I  Traaoltlen 


0  I  1  I  aadjdatal 
X  I  0  I  rev  dataS 


Madblaa  2  Stato  Tranaltleaa 


Wzam  I  To  I  Tranaltloa 


0  I  1  I  revjdatal 
1  I  0  I  andTdataZ 


Maeblno  3  Stato  Tranaltlona 


Trooi  I  To  I  Traaaltlon 


0111  rev_data2 
1  I  0  I  and  dataS 


CLOBU.  MUCSakBIIJCTT  OOPB 


■iI(in_tam^_biifn)^2(lii_biifr2,wil_lMll2)^lB_b«fl3^_b«n3),(CHANl,CHAN2,CHAN3) 


and_datal  1 
rovjdatal  2 
andjdata2  3 
rov_data2  4 
and~data3  5 
rev_data3  C 
andjdatal  7 
rev_datal  • 
and_data2  9 
rev_data2  10 
and_data3  11 
rev  data3  6 


SOMIMIT  or  nSCUBXLXTT  MULTSXS  (IIUX.T8X8  COIVLBTIO) 


Nuobor  of  atataa  ^anoratod  :12 
WiiaOiar  of  atataa  analyaad  :12 
Nuebar  of  doadloeka  :  0 

OMBXianiO  TWUISXTXOMS 
•••••WOO***** 


Figure  31:  Program  output  for  global  reachability  analysis 
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RBkaUSXLZTT  MULTfZS  of  trlag.oea 
SPICirZCATZOM 


1  UaehiM  1  Stato 

Ttaaaltiona  | 

1  rroM  1  To  1 

Traaaitloa  | 

and  datal  I 

rov_data3  | 

1  Maidilao  2  Stato 

Tranaltiona  | 

1  rroa  1  To  | 

Traaaltion  | 

1  0  1  1  1 

rev  datal  | 

1  1  1  0  1 

and_data2  | 

1  Maohlao  3  Stato 

Tranaltiona  | 

1  rroa  1  To  | 

Tranaltlon  | 

rev  data2  | 

mnuiDiui 

andjdataS  | 

STSTBM  lUUCBMIZI.ZtT  GRW8 


0 

I 

0, 

0, 

0 

] 

0 

and_datal 

1 

1 

t 

1, 

0, 

0 

J 

0 

rev_datal 

2 

2 

t 

1, 

1, 

0 

1 

0 

and_data2 

3 

3 

( 

1, 

0, 

0 

J 

1 

rev_data2 

4 

4 

[ 

1, 

0. 

1 

] 

0 

and_data3 

5 

5 

[ 

1, 

0, 

0 

] 

2 

rev_data3 

0 

SOMORT  or  RUraUZLZTT  MUX.TSZS  (MALTSIS  COIVLBTID) 


Muabor  of  otatoo  9onoc«tod  :C 
Nuatoor  of  atotoo  aaalyaod  :6 
Wuafiar  of  doadlooka  :  0 


onxicunD  nuwszTZOMs 

****nKw****** 


Figure  32:  Program  output  for  system  state  analysis^ 


2.  The  number  next  to  sign  shows  the  subscripts  that  is  explained  in  Chapter  II. 
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V.  EXAMPLES  FOR  USING  THE  MUSHROOM  PROGRAM 


In  this  Chapter,  the  programs  Simple  Mushroom,  Big  Mushroom,  and  Smart 
Mushroom  are  demonstrated  with  several  examples. 

The  Simple  Mushroom  program  will  be  used  to  analyze  a  simple  example  four 
machine  protocol  which  illustrates  some  important  aspects  of  the  program,  such  as 
detecting  unspecified  receptions,  unexecuted  transitions  etc.  Also,  the  information  transfer 
phase  of  a  full  duplex  LAP-B  protocol  specified  by  the  CFSM  model  will  be  analyzed.  This 
protocol  illustrates  a  larger  and  more  complex  analysis. 

The  Big  Mushroom  and  Smart  Mushroom  programs  will  be  used  to  analyze  the  GO 
BACK  N  protocol  with  a  window  size  of  10,  and  the  Token  Bus  protocol,  which  illustrates 
some  important  aspects  of  the  system  state  analysis. 

A.  CFSM  MODEL 

1.  A  Simple  Four  Machine  Protocol 

The  specification  of  the  protocol  using  the  CFSM  model  is  shown  in  Figure  33. 
Each  of  the  machines  sends/receives  a  message/acknowledgment  from  another  machine. 
Machines  2  and  3  also  have  another  send  transition  from  state  1  to  state  3.  The  FSM 
description  of  the  protocol  is  shown  in  Figure  34,  and  analysis  results  obtained  by  the 
Simple  Mushroom  program  are  shown  in  Figure  35.  The  analysis  generated  36  global  states. 
There  are  three  unspecified  receptions  and  one  unexecuted  transition.  No  deadlocks  or 
channel  overflows  are  recorded.  The  maximum  channel  size  is  2.  These  results  are  obtained 
by  simply  entering  the  FSM  text  file  into  the  program.  This  analysis  would  be  very 
cumbersome  to  do  manually,  even  for  a  simple  specification  like  this  one. 
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MACHINE  1 


MACHINE! 


MACHINE  3  MACHINE  4 


Figure  33:  Specification  for  the  example  four  machine  protocol 


Sian 

nuinber_d_machines  4 

machine  1 

state  1 

trans  -02  2 

slate  2 

trans +A  1  3 

machine  2 

stale  1 

trans -D  3  3 

trans  -f  D  2  1 

stale  2 

trans  -t-D  1 4 

machine  3 

stale  1 

trans  -A  3  1 

trans  -f D  2  2 

stale  2 

trans  -D I  4 

machine  4 

Slate  1 

trans  -t-D  2  3 
Slate  2 
trans  -D  1  2 
initial.state  1111 
finish 


Figure  34:  FSM  text  file  for  the  example  protocol 


49 


araczrxcuxe> 
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Figure  35:  Program  output  for  the  example  protocol 
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2.  Analysis  of  Information  Transfer  Phase  of  the  LAP>B  Protocol 

In  this  Section,  analysis  of  a  Data  Link  Control  (DLC)  protocol  is  described  using 
the  Simple  Mushroom  program.  The  LAP-B  protocol  is  modeled  and  analyzed  with  CFSM 
model  [Ref.  14].  A  simplified  analysis  of  the  information  transfer  phase  of  the  protocol, 
which  includes  only  I-frames  with  a  window  size  of  2,  will  be  described  below. 

This  analysis  is  important  in  two  ways.  First,  it  veriBes  that  the  program  is  correct 
by  obtaining  the  same  analysis  results  as  in  [Ref.  14].  Secondly,  it  is  a  good  example  to 
show  that  the  total  number  of  global  states  can  be  very  large,  even  for  such  a  limited 
protocol.  The  description  of  the  information  transfer  phase  is  explained  below  as  it  appears 
in  [Ref.  14]. 

The  network  nodes,  which  are  connected  by  the  protocol,  consist  of  a  Data 
Terminal  Equipment  (DTE)  and  a  Data  Circuit  Terminating  Equipment  (DCE).  In  this 
model,  DTE  and  DCE  are  considered  process  1  and  process  2  respectively.  Each  of  these 
processes  are  also  modeled  as  three  sub-processes:  Sender,  Receiver  and  Frame  Assembler 
Disassembler  (FAD),  which  are  numbered  as  1  or  2  according  to  their  process  numbers. 

Figure  36  shows  the  processes  and  how  they  are  connected.  The  FAD  process 
combines  data  blocks  from  the  Sender  with  acknowledgments  from  the  Receiver,  into 
complete  I-frames  and  sends  the  I-frames  to  the  FAD  of  the  other  process.  The  FAD  also 
breaks  up  the  I-frames  received  from  the  other  FAD  and  sends  the  acknowledgment  to  the 
Sender,  and  data  blocks  to  the  Receiver. 

I-frames  are  expressed  by  the  notation  ‘inm”,  where  n  is  the  send  sequence 
number  N(S),  and  m  is  the  receive  sequence  number  N(R).  The  message  “Di”  is  a  data 
block  sent  from  the  Sender  to  the  FAD,  or  from  the  FAD  to  the  receiver;  it  is  the  data  block 
which  is  to  be  placed  in,  or  which  is  taken  out  of,  the  I-frame.  The  “i”  in  “Di”  is  the  send 
sequence  number.  The  message  “Ai”  is  an  acknowledgment  with  a  receive  sequence 
number  of  i. 
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Figure  36:  Processes  Fot  the  Information  Transfer  Phase 


The  finite  state  machines  for  the  Sender,  Receiver  and  FAD  of  the  DTE  are  shown 
in  Figures  37,  38  and  39.  The  FSMs  for  the  DCE  are  the  same  except  that  FADl, 
RECEIVER  1,  and  SENDER  1  must  be  replaced  with  FAD2,  RECEIVER2,  and  SENDER2 
respectively.  Since  no  RR-frames  are  used,  I-fnunes  can  only  be  acknowledged  by 
receiving  an  N(R)  from  an  incoming  I-fntme. 

As  an  example,  suppose  the  DTE  Senderl  has  3  data  blocks  to  send.  It  can  go 
from  state  1  to  state  2,  sending  “EK).”  and  then  to  state  3,  sending  the  second  block  as  “Dl." 
At  this  point,  2  data  blocks  are  outstanding,  so  it  must  wait  for  an  acknowledgment  of  at 
least  one  of  them  before  sending  the  third. 

The  DTE  FADl  process,  initially  in  state  1,  will  receive  the  DO  from  Senderl  and 
enter  state  2.  It  then  sends  an  “enquiry”  to  the  Receiverl  to  get  the  latest  acknowledgment, 
an  N(R),  for  the  data  blocks  received  from  the  DCE. 

Since  no  data  blocks  have  been  received  by  the  DTE  yet,  Receiverl  will  respond 
with  an  “AO.”  FADl  will  receive  the  AO,  and  will  transition  from  state  8  to  1 1.  The  FADl 
will  then  return  to  state  1  sending  the  I-frame  “100.”  Similarly,  the  FADl  will  receive  the 
second  data  block,  Dl,  and  transmit  it  as  “110”  after  combining  with  “AO.” 

FAD2  will  receive  the  “100”  frame  first,  entering  state  20.  It  then  splits  this  I- 
frame  and  sends  the  “DO”  to  Receiver2,  and  “AO”  to  Sender2. 

Sender2  is  in  state  1,  and  simply  discards  this  “AO.”  Receiver2  is  in  state  1, 
accepts  the  “DO”  data  block  and  transitions  to  state  2. 

Similarly,  The  DCE  FAD2  process  receives  the  “110”  message,  and  sends  the 
“Dl”  to  Receiver  2,  and  “AO”  to  Sender  2.  Sender  2  will  discard  the  “AO”,  remaining  in 
state  1,  and  Receiver  2  will  receive  “Dl,”  transitioning  to  state  3. 

Suppose  at  this  point  a  user  data  block  becomes  available  to  send  at  the  DCE.  It 
will  send  an  “102”  frame  across  the  data  link  to  the  DTE;  and  upon  receiving  the  102,  the 
DTE  will  now  be  able  to  send  the  third  user  data  block. 
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Figure  37:  Sender  1  [Ref.  14] 
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Figure  38:  Receiver  1  [Ref.  14] 
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Figure  39b:  Frame  Assembler  Disassembler  FADl  (Disassembler  Part)  [Ref.  14] 


For  the  automated  analysis  of  the  protocol,  the  FSMs  in  Figures  37, 38,  and  39  are 
converted  to  a  text  file  and  entered  into  the  program  as  shown  in  Appendix  A.  The 
transition  names  in  this  text  file  are  the  same  as  in  the  FSM  diagrams,  such  as  “-flOO”, 
“4-DO”  etc.  In  order  to  save  memory  and  generate  a  larger  number  of  states  in  the  analysis, 
the  transition  names  can  be  abbreviated  to  single  characters  at  the  time  of  the  analysis  as 
shown  below: 


D0->X 

100 ->1 

D1  ->Y 

101  ->2 

D2  ->Z 

102 ->  3 

AO  ->A 

110 ->  4 

A1  ->B 

Ill  ->5 

A2  ->C 

112 ->  6 

ENQ  ->Q 

120 ->  7 
121  ->  8 
122 ->  9 

The  amount  of  memory  available  and  the  CPU  time  are  always  a  concern  for  a  full 
reachability  analysis.  The  program  output  for  the  analysis  is  partially  given  in  Appendix  A. 
Because  of  the  size  of  the  analysis,  only  a  very  small  portion  of  the  reachable  states  are 
included  in  the  output.  The  total  number  of  global  states  generated  for  the  information 
phase  was  73391.  There  were  no  unspecified  receptions,  unexecuted  transitions,  and 
channel  overflows.  The  maximum  channel  length  was  6.  A  deadlock  condition  was  found 
at  state  17034  where  all  the  channels  were  empty  and  Senderl,  Receiverl,  FADl,  FAD2, 
Sender2,  Receiver2  were  in  states  3,  3,  1,  1,  3,  3  respectively.  This  state  deadlock  is 
expected  since  RR-frames  are  not  included  in  the  analysis.  A  more  detailed  explanation 
including  the  RR-frames  in  the  protocol  is  given  in  [Ref.  14].  The  reader  may  note  that  the 
results  of  the  analysis  exactly  match  with  the  results  reported  in  Reference  14.  The 
deadlock  state  found  in  Reference  14  was  67699,  which  was  recorded  at  state  17034  in  this 
analysis.  However,  the  global  states  are  the  same  for  both  analyses.  The  Simple  Mushroom 
program  uses  a  Breadth-First  Search  algorithm  for  choosing  the  states  from  the  work  set 
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(i.e,  global  states  that  are  generated,  but  have  not  been  analyzed  yet).  The  protocol  verifler 
PROVE,  used  in  Reference  14  might  be  using  a  Depth  First  Search  approach,  which  would 
result  in  a  different  global  state  number. 

The  protocol,  including  the  RR-frames,  was  also  entered  into  the  program,  but  the 
program  could  not  complete  the  analysis  due  to  insufficient  computer  memory.  In  this 
analysis,  1S3S6S  global  states  were  generated.  No  unspecified  receptions,  deadlocks  or 
channel  overflows  were  recorded  for  the  analyzed  portion  of  the  protocol.  The  maximum 
channel  size  reached  was  4.  The  program  completed  the  analysis  in  1 1  hours  5 1  minutes  on 
a  Sun  SPARC  station. 

B.  SCM  MODEL 
1.  Go  Back  N 

The  first  protocol  selected  for  analysis  using  the  Big  Mushroom  and  Smart 
Mushroom  programs  is  a  1-way  data  transfer  protocol  with  a  variable  window  size,  which 
is  essentially  a  subset  of  the  High-level  Data  Link  Control  (HDLC)  class  of  protocols.  Hiis 
protocol  is  modeled  and  analyzed  with  the  SCM  model  in  [Ref.  1].  The  same  specification 
will  be  used  here  and  an  automated  analysis  will  be  described  using  the  programs 
developed  for  a  window  si^e  of  10.  The  specification  is  summarized  below; 

There  are  two  machines  in  the  system,  a  sender  (m;)  and  a  receiver  (m2).  The 

sender  sends  data  blocks  to  the  receiver,  which  are  numbered  sequentially,  0, 1 . w,  0, 1, 

...  for  a  window  size  of  w.  As  in  HDLC,  the  maximum  number  of  data  blocks  which  can  be 
sent  without  receiving  an  acknowledgment  is  w,  the  window  size.  The  receiver,  m2, 
receives  the  data  blocks  and  acknowledges  them  by  sending  the  sequence  number  of  the 
next  data  block  expected  (which  is  stored  in  local  variable  exp).  The  shared  variables 
DATA  and  SEQ  are  used  to  pass  messages  from  sender  to  receiver,  and  the  shared  variable 
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ACK  is  used  to  pass  acknowledgments  back  to  the  sender.  The  receiver  may  acknowledge 
any  number  of  blocks  received  up  to  the  window  size.  Upon  receiving  the 
acknowledgment,  the  sender  must  be  able  to  deduce  how  many  data  blocks  are  being 
acknowledged.  This  is  done  by  observing  the  difference  between  the  values  of  the  received 
acknowledgment  and  the  sequence  number  of  the  last  data  block  sent. 

The  general  specification  of  the  protocol  is  given  in  Figure  40  and  in  Table  4. 
Initially,  both  sender  and  receiver  are  in  state  0,  arrays  DATA  and  SEQ  are  empty,  and 
ACK  is  empty.  The  domains  of  DATA,  Rdata  and  Sdata  are  not  specified;  these  are  used 
to  hold  user  data  blocks.  Sdata  and  Rdata  are  the  interface  or  access  points  of  the  higher 
layer  (user)  protocol.  The  local  variables  for  the  sender  are  Sdata,  used  to  store  data  blocks, 
seq,  used  to  store  the  sequence  number  of  the  next  data  block  to  be  sent  out,  and  /,  used  as 
an  index  into  the  DATA  and  SEQ  arrays.  Initially  seq  is  set  to  0,  and  /  is  set  to  1.  The  local 
variables  of  the  receiver  are  Rdata,  exp,  and  j.  Rdata  is  used  to  receive  and  store  incoming 
data  blocks,  exp  to  hold  the  expected  sequence  number  of  the  next  incoming  data  block,  and 
j  is  an  index  into  the  shared  arrays  DATA  and  SEQ. 

The  states  of  both  sender  and  receiver  are  numbered  0, 1 . w,  and  each  state  has 

an  easily  recognized  intuitive  meaning.  If  the  sender  is  in  state  0,  then  all  data  blocks  sent 
to  date  have  been  received  by  the  receiver,  so  a  full  window  size  of  w  data  blocks  may  be 
sent  without  waiting  for  an  acknowledgment.  If  m;  is  in  state  tv,  then  a  full  window  of 
blocks  have  been  sent,  so  the  sender  can  only  wait  for  the  acknowledgment  from  the 
receiver. 

If  the  receiver,  m2,  is  in  state  0,  then  all  received  data  blocks  have  been 
acknowledged.  If  in  state  tv,  then  a  full  window  of  data  blocks  have  been  received,  but  not 
acknowledged.  Whenever  the  receiver  sends  an  acknowledgment,  all  data  blocks  received 
up  to  that  point  are  acknowledged. 
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Figure  40:  State  machines  and  variables  for  Go  Back  N 
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The  enabling  predicate  and  action  for  each  transition  are  shown  in  Table  4.  The 
label  or  transition  name  is  the  leftmost  column,  the  enabling  predicate  in  the  middle,  and 
the  corresponding  action  on  the  right  There  are  four  basic  types  of  transitions.  In  the 
sender,  m;,  the  -D  transition  transmits  a  data  block  by  placing  it  into  the  shared  variable 
DATA(/),  and  the  sequence  number  into  SEQ(i).  The  send  is  enabled  whenever  those 
variables  are  empty.  (The  inte^ction  between  the  sender  and  the  user,  or  higher  layer,  is 
implicit,  and  not  specified  here).  The  inc  operation  increments  its  arguments,  if  less  than 
their  maximum  value,  in  which  case  it  resets  them  to  the  minimum  value.  The  operator  0 
represents  the  inc  operation  repeated  k  times,  if  the  argument  is  k  and  the  symbol  e  denotes 
the  empty  value.  The  receive  transition  in  the  receiver,  m2,  is  enabled  whenever  a  data  block 
of  the  appropriate  sequence  number  is  in  the  yth  element  of  DATA  and  SEQ.  An 
acknowledgment  may  be  sent  by  m2  in  any  state  except  0,  in  which  case  no  unacknowledged 
data  blocks  have  been  received. 

The  remaining  transition  is  the  +Ai(  receive  acknowledgment,  in  mj.  If  mj  is  in 
state  u,\^u^w,  and  there  is  a  nonempty  value  in  shared  variable  ACK,  then  exactly  one 
of  the  transitions  +Aq,  +Ai,  ...,  will  be  enabled;  it  will  be  that  A*  such  that  the 
predicate  ACK0k  =  seq  is  true,  and  the  next  state  is  k.  [Ref.  1] 

For  analyzing  this  protocol  using  the  Big  Mushroom  and  Smart  Mushroom 
programs,  the  inputs  to  the  program  must  be  completed.  These  consist  of  a  text  file 
description  of  FSMs,  the  package,  definitions,  which  include  the  variables  of  the  protocol, 
and  the  subprograms  Analyze  Predicates  Machines  and  Action,  which  define  the 
predicate-action  table.  Also  an  Output  Gtuple  procedure,  which  defines  the  output  format 
for  the  global  tuples,  must  be  entered.  Completed  packages/procedures  for  a  window  size 
of  10  are  given  in  Appendix  B. 

The  same  names  are  used  for  local  and  shared  variables  in  the  package  definitions 
as  in  the  predicate-action  table.  Variables  DATA,  ACK  and  Sdata  are  declared  as  one 
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dimensional  arrays  of  size  10,  which  is  the  window  size.  Lxx;al  variables  seq  and  exp  and 
index  numbers  i  and  j  are  declared  as  integers  in  the  range  0  to  10.  Global  variable  ACK  is 
declared  as  integer  in  the  range  -1  to  10,  where  -1  represents  E  value  in  the  predicate-action 
table.  An  enumeration  type,  bi^er  type,  is  declared  for  storing  the  data  passed  by  the  upper 
layer  to  local  variable  Sdata.  Data  are  declared  as  dO,  dl, ..,  d9,e,  where  e  represents  the  e 
value.  Transition  names  in  the  specification  are  deflned  as  sndjdata,  rcv  data,  snd_ack, 
rcv  acki  for  -D,  +D,  -A,  and  +Ai  in  predicate-action  table  respectively. 

Actions  and  predicates  are  also  translated  to  Ada  statements  in  the  subprograms 
Analyze jjredicates  Machines  and  Action.  For  each  state  in  both  machines  there  is  a 
“when”  statement.  The  predicates  for  the  outgoing  transitions  from  that  state  are  translated 
to  Ada  with  “if’  conditional  statements.  Actions  in  the  predicate-action  table  are  converted 
to  Ada  statements  with  “when”  statements  (see  Appendix  B). 

The  program  generated  286  system  states  and  31,460  global  states,  which  are 
identical  with  the  results  obtained  by  the  formulas  given  in  [Ref.  1].  The  protocol  is  free 
from  deadlocks  and  there  are  no  unexecuted  transitions.  The  difference  between  the 
number  of  system  and  global  states  shows  the  power  of  the  system  state  analysis  which 
reduced  the  number  of  states  in  the  reachability  graph  exponentially.  However,  without  the 
Smart  Mushroom  program,  the  system  state  analysis  would  be  cumbersome  to  do  manually, 
and  the  global  reachability  analysis  would  be  infeasible. 

2.  Token  Bus 

Another  example  of  the  program  application,  the  token  bus  speciflcation  in  [Ref. 
15]  will  be  used.  The  specification  is  a  simplified  one.  It  assumes  that  the  transmission 
medium  is  error  free  and  all  transmitted  messages  are  received  undamaged.  Both  the  system 
state  analysis  and  global  analysis  are  generated  from  this  token  bus  specification  for  a 
protocol  consisting  of  8  machines. 
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The  specification  of  this  simpliHed  protocol  is  given  in  Figure  41  and  Table  5.  The 
FSM  diagram  and  the  local  variables  are  the  same  for  each  machine,  where  the  transition 
names:  ready,  rev,  pass,  get-tk,  pass-tk,  Xmit,  and  moreD  are  appended  with  the 
corresponding  machine  number  to  the  end  for  each  machine  in  the  specification.  For 
example,  transitions  for  machine  7  are  named  as  ready?,  rcv7,  pass?,  etc.  This  makes  it 
easier  to  follow  the  reachability  graphs.  The  remainder  of  the  protocol  specificadon  as 
described  in  Reference  15  is  as  follows:  The  shared  variable,  MEDIUM,  is  used  to  model 
the  bus,  which  is  “shared”  by  each  machine.  A  transmission  onto  the  bus  is  modeled  by  a 
write  into  the  shared  variable.  The  fields  of  this  variable  correspond  to  the  parts  of  the 
transmitted  message:  the  first  fleld,  MEDIUM.T,  takes  the  values  T  or  D,  which  indicate 
whether  the  frame  is  a  token  or  a  data  frame.  The  second  field  contains  the  address  of  the 
station  to  which  the  message  is  transmitted  (DA  for  “destination  address”);  the  next  Held, 
the  originator  (SA  for  “source  address”);  and  finally  the  data  block  itself. 

The  network  stations,  or  machines,  are  defined  by  a  finite  state  machine,  a  set  of 
local  variables,  and  a  predicate-action  table.  The  initial  state  of  each  machine  is  state  0,  and 
the  shared  variable  is  initially  set  to  contain  the  token  with  the  address  of  one  of  the  stations 
in  the  “DA”  field. 

The  value  of  local  variable  next  is  the  address  of  the  next  or  downstream  neighbor, 
and  these  are  initialized  so  that  the  entire  netwoik  forms  a  cycle,  or  logical  ring. 

The  local  variable  i  is  used  to  store  the  station’s  own  address.  As  implied  by  the 
names,  the  local  variables  /nbt^and  outbirf art  used  for  storing  data  blocks  to  be  transmitted 
to  or  retrieved  from  other  machines  on  the  network.  The  latter  of  these,  outbirf,  is  an  array 
and  thus  can  store  a  potentially  large  number  of  data  blocks.  The  local  variable  ctr  serves 
to  count  the  number  of  blocks  sent;  it  is  an  upper  bound  on  the  number  of  blocks  which  can 
be  sent  during  a  single  token  holding  period.  The  local  variable  j  is  an  index  into  the  array 
outbuf. 
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Figure  41 :  FSM  and  variables  for  the  network  nodes 

The  local  variables  j  and  ctr  are  initially  set  to  1,  and  inbitf  and  oMbirfan  initially 
set  to  empty.  The  shared  variable  MEDIUM  initially  contains  the  token,  with  the  address  of 
the  station  in  the  OA  field.  Thus  the  initial  system  state  tuple  is  (0,0, ...,  0)  and  the  first 
transition  taken  will  be  get-tk  by  the  station  which  has  its  local  variable  i  equal  to 
MEDIUM  DA. 

Each  machine  has  four  states.  In  the  initial  state,  0,  the  stations  are  waiting  to 
either  receive  a  message  from  another  station,  or  the  token.  If  the  token  appears  in  the 
variable  MEDIUM  with  the  station’s  own  address,  the  transition  to  state  2  is  taken.  When 
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taking  the  get-tk  transition,  the  machine  clears  the  communication  medium  and  sets  the 
message  counter  ctr  to  1.  In  state  2,  the  station  transmits  any  data  blocks  it  has,  moving  to 
state  3,  or  passes  the  token,  returning  to  state  0.  In  state  3,  the  station  will  return  to  state  2 
if  any  additional  blocks  are  to  be  sent,  until  die  maximum  count  k  is  reached.  When  the 
count  is  reached,  or  when  all  the  station’s  messages  have  been  sent,  the  station  returns  to 
state  0. 

The  receiving  station,  as  with  all  stations  not  in  possession  of  the  token,  will  be  in 
state  0.  The  message  will  appear  in  MEDIUM,  with  the  receiving  station’s  address  in  the 
DA  field.  The  receiving  transition  to  state  1  will  then  be  taken,  the  data  block  copied,  and 
MEDIUM  cleared.  By  clearing  the  medium,  the  receiving  station  enables  the  sending 
station  to  return  to  its  initial  state  (0)  or  to  its  sending  state  (2). 


TABLE  5:  PREDICATE-ACTION  TABLE  FOR  THE  NETWORK  NODES 


Transition 

Enabling  Predicate 

Action 

rev 

MEDIUM.{t,DA)  =  {D,i) 

inbttf*-MEDIUM.iSA,  data) 

ready 

true 

MEDIUM  <-  0 

get-tk 

MEDIUM,  (r,  DA)  =  (T,  i) 

MEDIUM  <-  0;  ctr  / 

pass 

outbvf\j\  =0 

MEDIUM  «-  ( T,  next,  i,  0) 

Xmit 

outbirf\j]*0 

MEDIUM  i-  outbitf\j]  -, 
ctr  <-  ctr  ®  7;  y «-  y  ©  / 
outbirfU]  «-0 

moreD 

MEDIUM  =  0  A  outbuf\j\  *  0 

null 

pass-tk 

MEDIUM  =  0  A 
( outbitfU]  =  0v  ctr  =  k+  I) 

MEDIUM  <-  ( T,  next,  i,  p) 
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The  symbol  “0”  indicates  that  the  variable  should  be  incremented  unless  its 
maximum  value  has  been  reached,  in  which  case  it  should  be  reset  to  the  initial  value.  The 
notation  MEDIUM. (t,  DA)  is  used  to  denote  the  first  two  fields  of  the  variable  MEDIUM. 
For  example,  MEDIUM.it,  DA)  =  (T,  i)  is  a  boolean  expression  which  is  true  if  and  only  if 
the  first  field  of  MEDIUM  contains  the  value  T,  and  the  second  field  contains  the  value  i. 
Other  notations  in  the  predicate-action  table  such  as  “a”,  “v”,  etc.  are  intuitive. 

The  inputs  to  the  program  for  the  reachability  analysis  of  this  protocol  are  given 
in  Appendix  C.  The  same  names  as  in  the  specification  are  used  for  the  local  and  global 
variables  in  the  package  defimtions.  Also,  the  “empty”  value  is  represented  by  “E”  and  the 
data  are  represented  by  “I”  in  this  package.  The  upper  bound  on  the  number  of  data  blocks 
in  the  outbitf  variable  is  set  to  7. 

The  system  state  analysis  alone  did  not  give  a  complete  analysis  due  to  some 
loops  in  the  FSMs  of  the  SCM  specification.  Since  the  system  state  analysis  assumes  that 
two  system  states  are  equivalent  if  both  the  machine  state  tuples  and  the  outgoing 
transitions  are  the  same,  this  can  cause  the  system  state  analysis  to  give  insufficient  results 
in  some  special  cases.  For  example,  incomplete  results  can  arise  when  the  FSMs  of  the 
specification  include  some  loops  that  result  with  the  same  states  and  enabled  transitions 
repeatedly.  In  such  specifications,  some  of  the  transitions  will  stay  unexecuted,  resulting  an 
incomplete  analysis.  This  situation  is  observed  in  this  specification  when  one  of  the 
machines  had  two  or  more  data  blocks  in  its  ourbuf  local  variable.  For  instance,  if  machine 
1  has  two  data  blocks  in  its  ourbu/ local  variable  waiting  for  transmission  and  it  receives 
the  token  from  MEDIUM,  it  transitions  to  state  2  with  get-tk  and  then  takes  the  Xmit 
transition  to  state  3,  sending  the  first  data  block.  Since  it  has  one  more  data  block  to  send, 
the  next  transition  will  be  moreD,  which  will  take  it  back  to  state  2.  At  this  point  the  system 
state  analysis  will  stop  and  the  reachability  analysis  will  be  incomplete. 


68 


The  problem  can  be  solved  by  splitting  the  system  state  analysis  into  three  parts. 
First,  the  protocol  can  be  analyzed  with  no  messages  in  the  machines  and  the  behavior  of 
the  machines  including  only  the  transitions  of  the  token  can  be  observed  (transitions  get-tk 
and  pass).  Then,  the  analysis  can  be  performed  with  one  message  in  the  outbirf  local 
variables  of  the  machines,  which  allows  us  to  analyze  the  transitions  for  receiving/ 
transmitting  the  messages  in  addition  to  the  transitions  including  the  token  (get-tk,  Xmit, 
rev,  ready,  pass-tk).  Finally,  the  protocol  can  be  analyzed  with  each  machine  having  more 
than  one  message,  which  includes  the  last  transition  in  the  analysis  (moreD).  Combining 
the  results  of  these  parts  shows  that  the  protocol  is  free  from  deadlocks  and  there  are  no 
unexecuted  transitions. 

The  definitions  packages  and  the  analysis  results  are  given  separately  for  each  of 
the  three  cases  outlined  above  in  Appendix  C.  The  system  state  analysis  generated  16, 40 
and  5  system  states  respectively  for  the  parts  explained  above.  The  global  analysis  has 
generated  263  global  states  and  there  were  no  deadlocks  or  unexecuted  transitions.  The 
global  reachability  analysis  is  also  given  in  Appendix  C. 

The  system  state  analysis  has  reduced  the  number  of  states  from  263  (global)  to 
61  (for  all  three  parts).  This  is  another  example  showing  the  advantage  of  the  system  state 
analysis. 
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VI.  CONCLUSIONS  AND  FURTHER  RESEARCH  POSSIBILITIES 


In  this  thesis,  a  software  tool  has  been  described  which  automates  the  analysis  of 
protocols  specified  by  the  SCM  and  CFSM  models.  The  program  generates  either  the 
system  state  analysis  or  global  reachability  analysis  for  the  SCM  model.  The  program  also 
generates  the  full  reachability  graph  for  a  protocol  specified  by  the  CFSM  model. 

The  major  achievement  of  the  thesis  was  the  increase  in  the  number  of  machines  in  the 
protocol  specification.  The  previous  work  in  [Ref.  8]  was  extended  to  allow  two  to  eight 
machines  in  the  specification.  The  run  time  and  memory  efficiency  of  the  program  were 
improved  to  allow  the  analysis  of  larger  and  more  complex  protocols.  The  user  interface  of 
the  program  has  also  been  improved. 

The  system  state  analysis  reduces  the  size  of  the  state  space  greatly,  but  in  some  cases, 
when  the  system  state  analysis  is  not  sufficient  for  the  protocol  analysis,  the  global 
reachability  analysis  is  required.  The  Smart  Mushroom  program  generates  the  system  state 
graph.  The  Simple  and  Big  Mushroom  programs  are  based  on  exhaustive  analysis,  and 
generate  the  full  global  reachability  graph.  The  main  problem  in  these  programs  is  the 
“state  space  explosion.”  As  stated  in  [Ref.  16],  an  estimate  for  the  maximum  size  of  the 

state  space  that  can  be  reached  for  a  full  reachability  analysis  is  about  10^  states.  This  is  in 
agreement  with  the  maximum  number  of  states  generated  so  far  using  the  Big  Mushroom 

program  (153565  =  1.53  x  10^  states  were  generated  for  the  example  protocol  described  in 
Chapter  V). 

The  size  of  the  state  space  which  can  be  generated  is  directly  proportional  with  the 
memory  available  on  the  computer.  For  a  full  reachability  graph,  an  equation  can  be  derived 
for  determining  the  maximum  number  of  states:  where. 
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M;  Memory  available  on  the  computer  (bytes). 

S:  Amount  of  memory  for  storing  one  system  state  (bytes). 

O:  Overtiead  (memory  for  storing  tl^  program  and  other  data  structures  etc.). 

Then,  the  number  of  states  that  can  be  analyzed  is:  N  =  (M-0)/S.  Usually  O  «  M,  and 
O  can  be  ignored.  For  instance,  for  the  LAP-B  protocol  analysis  described  in  Chapter  V, 
M=80  MBytes,  S  =  516  bytes,  and  N  =  162596.  In  this  analysis,  only  153565  states  were 
generated  by  the  Simple  Mushroom  program.  The  difference  between  these  numbers  is  due 
to  the  exclusion  of  the  overhead  in  the  calculation.  Unfortunately  memory  was  not  enough 
for  a  100%  coverage  in  this  analysis. 

In  spite  of  the  state  space  explosion,  the  programs  developed  in  this  thesis  are  still  very 
helpful  for  analyzing  protocols.  A  full  reachability  analysis  may  be  feasible  by  keeping  the 
protocol  specifications  as  simple  as  possible,  and  using  certain  assumptions  about  the 
behavior  of  the  protocol  to  reduce  the  size  of  the  state  space.  For  example,  the  size  of  the 
message  queue  is  very  important  for  the  CFSM  model.  A  smaller  message  queue  decreases 
S  and  allows  to  analyze  larger  protocols.  A  specification  with  less  number  of  processes 
increases  the  number  of  states  that  can  be  analyzed.  Modeling  the  machines  with  less 
number  of  states  is  also  helpful.  For  the  SCM  model,  N  can  be  increased  by  keeping  the 
size  of  global  and  local  variables  as  small  as  possible.  A  simpler  protocol  specification  also 
reduces  the  run  time. 

But,  in  some  cases,  even  after  some  simplifications,  a  full  reachability  analysis  is 
impossible.  Fortunately,  still  some  solutions  exist  for  the  automated  protocol  analysis.  One 
method  which  is  described  in  [Ref.  16]  is  using  the  supertrace  algorithm.  In  the  Mushroom 
program,  hashing  is  used  to  increase  the  search  efficiency.  In  the  supertrace  algorithm  a 
very  large  hash  size  (almost  the  whole  available  memory)  is  used,  and  system  states  are  not 
stored.  This  method  is  explained  in  [Ref.  16].  For  example,  with  a  10  MB  of  memory,  80 
million  states  can  be  generated  using  this  method  as  described  in  [Ref.  16].  Of  course  this 
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efficiency  does  not  come  free.  Due  to  hash  conflicts,  this  method  cannot  guarantee  100% 
coverage,  but  as  a  partial  search  technique,  this  algorithm  is  very  powerful. 

This  thesis  opens  several  areas  for  further  work.  One  improvement  would  be  to 
increase  the  size  of  the  system  space  that  can  be  analyzed.  Adding  the  supertrace  option  to 
the  Mushroom  program  can  be  a  good  area  for  further  work. 

The  number  of  reachable  states  is  usually  very  large  and  it  would  be  awkward  to  print 
out  or  browse  through  the  listing.  Another  improvement  would  be  to  store  the  reachability 
analysis  results  in  the  form  of  a  database,  and  provide  a  query  language  that  allows  the  user 
to  easily  analyze  the  results  of  the  analysis  as  suggested  in  [Ref.  17]  (for  instance,  querying 
the  error  sequences  and  certain  paths  between  any  two  states  etc.). 

Finally,  another  research  possibility  would  be  to  add  a  simulator  module  to  the 
Mushroom.  For  protocols  with  a  large  size  of  state  space,  where  full  reachability  analysis 
is  infeasible,  simulation  would  be  useful. 

The  Ada  programming  language  was  used  to  develop  Mushroom.  Also,  specification 
of  the  SCM  model  must  be  entered  to  the  program  using  Ada  subprograms  and  packages. 
Ada  is  a  well-structured  programming  language,  and  supports  the  modular  development  of 
programs.  Also,  exception  handling,  generic  units,  and  tasking  are  important  features  of 
Ada.  These  features  were  helpful  in  developing  the  program.  The  well-structured  property 
of  the  programming  language  makes  the  input  of  the  specification  easier.  The  tasking 
mechanism  of  Ada  would  be  very  helpful  to  develop  a  simulator  module  for  the  program. 

The  Simple  Mushroom  program  is  used  as  a  teaching  aid  in  an  introductory 
communications  network  course  at  Naval  Postgraduate  School.  This  can  be  another  area 
where  student  can  use  the  tool  as  an  aid  in  learning  the  protocol  design  and  analysis. 

The  mushroom  program  is  a  tool  which  it  is  hoped  that  it  will  greatly  improve  the 
design  and  analysis  of  protocols  specified  by  the  SCM  and  CFSM  models.  Especially,  this 
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program  may  help  to  solve  stmie  questions  concerning  the  SCM  model  which  have  not  been 
completely  answered. 
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APPENDIX  A  (LAP'S  Protocol  Information  Transfer  Phase) 


FSM  Text  File 


■last 

BOidMr  of  —ntilnoo  < 
MakiM  1~ 

■tato  1 
tzaaa  *»0  1  3 
traaO  -00  2  3 
atata  2 
tzaaa  2  3 
tzaaa  -01  3  3 
tzaaa  4kl  4  3 
atata  3 
tzaaa  4M  3  3 
tzaaa  4A1  5  3 
tzaaa  4*2  7  3 
atata  4 
tzaaa  4*1  4  3 
tzaaa  -01  S  3 
atata  S 
tzaaa  4*1  5  3 
tzaaa  4*2  7  3 
tzaaa  -02  4  3 
atata  4 
tzaaa  4*1  4  3 
tzaaa  4*0  1  3 
tzaaa  4*2  •  3 
atata  7 
tzaaa  4*2  7  3 
tzaaa  -02  4  3 
atata  ■ 
tzaaa  4*2  4  3 
tzaaa  4*0  1  3 
tzaaa  -00  •  3 
atata  • 
tzaaa  4*2  •  3 
tzaaa  4*0  2  3 
tzaaa  4*1  4  3 
MOhlaa  2 
atata  1 

tzaaa  400  4  3 
tzaaa  400  2  3 
atata  2 

tzaaa  4nK|  5  3 
tzaaa  401  3  3 

atata  3 

tzaaa  400  4  3 
tzaaa  402  1  3 
atata  4 
tzaaa  -*0  1  3 
atata  5 
tzaaa  -*1  2  3 
atata  4 
tzaaa  -*233 
aaehlaa  3 
atata  1 
tzaaa  400  2  1 
tzaaa  401  3  1 
tzaaa  402  4  1 
tzaaa  4100  20  4 
tzaaa  4X10  21  4 
tzaaa  4X20  22  4 
tzaaa  4X01  23  4 
tzaaa  4X11  24  4 
tzaaa  4X21  23  4 
tzaaa  4X02  24  4 
tzaaa  4X12  27  4 
tzaaa  4X22  24  4 
atata  2 

tzaaa  -me  4  2 

atata  3 

tzaaa  -400  9  2 

atata  4 

tzaaa  -OQ  10  2 
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■tat* 

• 

traaa 

4*0 

11  2 

trasa 

4*1 

12  2 

traaa 

4*1 

13  2 

■tat* 

• 

tr*Ba 

4*0 

14  2 

traaa 

4*1 

15  2 

traaa 

4*2 

14  2 

■tat* 

10 

traaa 

4*0 

17  2 

traaa 

4*1 

10  2 

traaa 

4*2 

It  2 

■tat* 

11 

traaa 

-ZOO 

1  4 

■tat* 

12 

traaa 

-ZOl 

1  4 

■tat* 

13 

traaa 

-202 

1  4 

■tata 

14 

traaa 

-ZlO 

1  4 

■tat* 

15 

traaa 

-111 

1  4 

■tat* 

14 

traaa 

-ZlZ 

1  4 

■tat* 

IT 

traaa 

-120 

1  1  4 

■tat* 

It 

traaa 

-121 

1  4 

■tat* 

It 

traaa 

-122 

1  4 

■tat* 

20 

traaa 

-DO 

2t  2 

■tat* 

21 

traaa 

-01 

2t  2 

■tat* 

22 

traaa 

-02 

2t  2 

■tat* 

23 

traaa 

-00 

30  2 

■tat* 

24 

traaa 

-01 

30  2 

■tat* 

25 

traaa 

•02 

30  2 

■tat* 

2« 

traaa 

-DO 

31  2 

■tat* 

n 

traaa 

-01 

31  2 

■tat* 

20 

traaa 

-02 

31  2 

■tat* 

20 

traaa 

-*0 

1  1 

■tat* 

30 

traaa 

-*1 

1  1 

■tat* 

31 

traaa 

-*2 

1  1 

aanhina  4 

■tat* 

\ 

traaa 

4D0 

2  5 

traaa 

401 

3  5 

traaa 

402 

4  5 

traaa 

4Z00  20  3 

traaa 

4X10  21  3 

traaa 

4X20  22  3 

traaa 

4X01 

.  23  3 

traaa 

4X11 

.  24  3 

traaa 

4X21 

.  25  3 

traaa 

4X02  24  3 

traaa 

4X12  27  3 

traaa 

4X22  20  3 

■tat* 

2 

traaa 

•OMQ  0  4 

■tat* 

3 

traaa 

-!■( 

(  t  4 

atat* 

4 

traaa 

-me 

1  10  4 

■tat* 

0 

traaa 

4*0 

11  4 

traaa 

4*1 

12  4 

traaa 

4*2 

13  4 
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•tat*  • 

traas  *M0  14  4 
txaaa  4*1  15  t 
tzaaa  4*2  14  4 
atmtm  10 
txaaa  4*0  17  4 
txaaa  4*1  10  4 
txaaa  4*2  10  4 
•tata  11 
txaaa  -ZOO  1  3 
•tata  12 
txaaa  -101  1  3 
atata  13 
txaaa  -102  1  3 
atata  14 
atata  IS 
txaaa  -Ill  1  3 
•tata  14 
txaaa  -112  1  3 
•tata  17 
txaaa  -120  1  3 
txaaa  -110  1  3 
txaaa  -DO  •  4 
•tata  10 
txaaa  -121  1  3 
atata  10 
txaaa  -122  1  3 
atata  20 
txaaa  -00  29  4 
atata  21 
txaaa  -D1  29  4 
•tata  22 
txaaa  -D2  29  4 
•tata  23 
txaaa  -DO  30  4 
atata  24 
txaaa  -D1  30  4 
•tata  29 
txaaa  -02  30  4 
•tata  24 
txaaa  -DO  31  4 
•tata  27 
txaaa  -D1  31  4 
•tata  24 
txaaa  -D2  31  4 
•tata  29 
txaaa  -*0  1  5 
atata  30 
txaaa  -*1  1  9 
•tata  31 
txaaa  -*2  1  9 
aanhIiiT  9 
•tata  1 
txaaa  4*0  1  4 
txaaa  -DO  2  4 
•tata  2 
txaaa  4*0  2  4 
txaaa  -01  3  4 
txaaa  4*1  4  4 
•tata  3 
txaaa  4*0  3  4 
txaaa  4*1  5  4 
txaaa  4*2  7  4 
atata  4 
txaaa  4*1  4  4 
txaaa  -D1  9  4 
atata  9 
txaaa  4*1  9  4 
txaaa  4*2  7  4 
txaaa  -D2  4  4 
•tata  4 
txaaa  4*1  4  4 
txaaa  4*0  1  4 
txaaa  4*2  9  4 
•tata  7 
txaaa  4*2  7  4 
txaaa  -02  9  4 
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■t«t«  • 

txua  4A2  •  4 
tnaa  4M  1  4 
^x«Ba  -BO  •  4 
•tat*  • 
tcaaa  4*2  •  4 
txaaa  4M  2  4 
trana  4A1  4  4 
—nhlin  4 
■tata  1 

txaaa  4BBa  4  4 
txaaa  400  2  4 
atata  2 

txaaa  4BBa  S  4 
txaaa  401  3  4 
•tata  3 

txaaa  4na  4  4 

txaaa  402  1  4 

•tata  4 

txaaa  -AO  1  4 

atata  5 

txaaa  -A1  2  4 

•tata  4 

txaaa  -A2  3  4 

ialttal  atata  111111 

flaiah  ~ 


Program  Output 

RSACBABZLITT  ANALYSIS  of  :  Yad.faa 

snczricATzoN 


1 

Maehlna  1 

Stata  Traaaitlona 

1 

1 

Tram 

1  »o  1 

etbax  aaebina  )  Xxaasttlen 

1 

1 

1 

1  1  1 

3 

t  r 

AO 

1 

1 

1 

1  2  1 

3 

1  • 

DO 

1 

1 

2 

1  2  1 

3 

1  t 

AO 

1 

1 

2 

1  3  1 

3 

1  0 

D1 

1 

1 

2 

1  4  1 

3 

1  r 

A1 

1 

1 

3 

1  3  1 

3 

1 

AO 

1 

1 

3 

1  5  1 

3 

1  ^ 

A1 

1 

1 

3 

1  f  1 

3 

1  r 

A2 

1 

1 

4 

1  4  1 

3 

1  r 

A1 

1 

1 

4 

1  5  1 

3 

1  0 

D1 

1 

1 

5 

1  5  1 

3 

i  ^ 

A1 

1 

1 

5 

1  7  1 

3 

1  r 

A2 

1 

1 

5 

1  4  1 

3 

1  0 

D2 

1 

1 

6 

1  4  1 

3 

1  r 

A1 

1 

1 

6 

1  1  1 

3 

1 

AO 

1 

1 

4 

1  a  1 

3 

1  r 

A2 

1 

1 

7 

1  7  1 

3 

1  r 

A2 

1 

1 

7 

1  4  1 

3 

1  0 

D2 

1 

1 

a 

1  a  1 

3 

I  Jc 

A2 

1 

1 

S 

1  1  1 

3 

1  r 

AO 

1 

1 

a 

1  9  1 

3 

1  0 

DO 

1 

1 

9 

1  9  1 

3 

1  r 

A2 

1 

1 

9 

1  2  1 

3 

1  r 

AO 

1 

1 

9 

1  4  1 

3 

1  ^ 

A1 

1 
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1 

rroai 

1  »o  1 

etbar  aaohiiM  |  Tranaltlen 

1 

1 

1 

1  4  1 

3 

1  r 

BBQ 

1 

1 

1 

1  2  1 

3 

1  r 

DO 

1 

1 

2 

1  S  1 

3 

1  r 

B«Q 

1 

1 

2 

1  3  1 

3 

1  r 

DX 

1 

1 

3 

1  4  1 

3 

1  r 

no 

1 

1 

3 

1  1  1 

3 

1  t 

D2 

1 

1 

4 

1  X  1 

3 

1  a 

AO 

1 

1 

S 

1  2  1 

3 

1  • 

AX 

1 

1 

< 

1  3  1 

3 

1  a 

A2 

1 

I  MaehifM  6  Stmtm  Vr«naitlona  | 


1  Fre« 

1  »o 

1 

othar  aAchlna 

1 

Tcanaltlon 

1  X 

1  4 

1 

4 

1 

r 

BMQ 

1  X 

1  2 

1 

4 

1 

r 

DO 

1  2 

1  S 

1 

4 

1 

r 

IMQ 

1  2 

1  3 

1 

4 

1 

r 

Dl 

1  3 

1  4 

1 

4 

1 

r 

no 

1  3 

1  X 

1 

4 

1 

r 

D2 

1  4 

1  X 

1 

4 

1 

• 

AO 

1  5 

1  2 

1 

4 

1 

• 

A1 

1  6 

1  3 

1 

4 

1 

B 

A2 

REACHABILITY  GRAPH 


1  (  1,E3;E4;E,  l^E^E^  I.E,EAE,E.  14;E^E^  I,E,E4:«;  I,iyE,EAEJ 
•DO  3  1 2,E,D0,E^  1.E.EAE.E,  I  j:^E,E,  LE^E^  1,E.E.E«E;1,E4;E^E}  2 

-DO  4  ( i,E4;i;E4;  i,e.e,e4;e,  i,e^e,e,  f  .e.e,e4:j;2^e;e,do,e;  i^e3;e]  3 

2 1 2,E,D0^E,  14;E,E«E,  I^E^E^  1£E.E,E4;  1,EAE,EA  l.E^E^E] 

-Dl  3  1 3,E4I0  D1 AEA  1,E.EAEJE;  1.E^E,E4;  I.E,E,EAE,  1  AE^E,  14;E^E^1  4 

4D01I2,E,E,EAE.I^E,EAE,2«E^E,E.l^E^E3;i4;E^E^l.E4:je^)  5 

-DO  4  1 2.E,DO^E. l.E.E,E.EJE, I.E^E^  I.E,E,E^E,2.EAEJ)0^ I,E.E.E,E^!I  6 

3  [  I,E4:^E^  1,E,E,EAE,  l,E^E^E,  1^EAE,2,E,E.E4)0  ^  1,E,E;E.E,E) 

-DO  3  |2.E4>04:^E.14;E,E,E^i,E^E^l,E,E,E,E^2,E^E4)0^14;E,E,E^)  6 

+DO  5  I  I,E,E,E^ l,E^f;E.E.  1,E,E^E,24;E,E,E^2,EAE,E^  1.E,E,E^]  7 

-Dl  4  I  I,EAE.E4;  I.E^E3;E,  I4;E,E,E.E,  I^E,E^3.E.E.E,D0DI  ,E,  l^E,E,Ef  ]  S 

4  J  3 ADO  Dl  ,E,EA  1.EAE,E,E,  I.EAE.EA  I.EAEAE,  I  AE;EAE,  1  AE,EAE1 

♦DO  1 1 3,E4>I  AEA I  AE,E,EA2.EAEAE,  1,E,E,EAE, I AE,EAE.  1  AE,EAE]  * 

-D04  (3,EJMD1  AEALEAEAE.1,EAE,EA1AE.EAE,2,E,EAD0ALEAEAE1  10 

5 1  2,EAE,EA  LEAEAE,  2,E.E,EAE.  1.EAEAE,  I AEAEA I  AEAEAl 
-Dl  3 1 3ADI  .EAE,  1  AE,E,EA2.E,EAEA  I.EAEAE,  LEAE,E,E,  1  AEAE,E1  9 

-ENQ  2  1 2AEAE,E,  1  AE,E,E,E,S.E^NQ  AEA  IAE,EAE,  I.EAEAE.  1  AEAE,E1  II 

-DO  4 1 2.E,E,E,EA  I  AE,E,E,E.2AE,E,E,E,  1  AEAE.E.2AEAD0  A I  AEAE,E1  12 
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73391. . . 


I,’,  n  I  fi  »’incn  (.-f (TiyT  I J  « 3«  a  3l  iV 


Total  Bimibcr  ornaici  |ca«ratcd  :  73391 
NoMbcr  oralalca  analyacd  :  73391 
BMMbcr  of  deadlock* :  1 
Mnbcr  oroMpcdflcd  reccptioM :  0 
Maxtaioiii  wntmtgt  qucoc  die ;  6 
ckaMd  overflow ;  NONE 

UNEXECUTED  TRANSITIONS 

••••NONE*'** 
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APPENDIX  B  (Go  back  N  Window  Size  of  10) 


FSM  Text  File 


■tart 

■■■bar  of  aanhlnaa  2 
■anhln?  1~ 


■tata 

0 

txaaa 

■ad  data 

1 

■tata 

1  “ 

traaa 

raT_aakO 

0 

traaa 

■ad~data 

2 

■tata 

2  “ 

traaa 

reT_aakO 

0 

traaa 

raT~aekl 

1 

traaa 

■ad~data 

3 

■tata 

3  “ 

traaa 

rea_aak0 

0 

traaa 

r0r~aakl 

1 

traaa 

rer~aak2 

2 

traaa 

■ad~data 

4 

■tata 

4  “ 

traaa 

ra«'_aek0 

0 

traaa 

ra*~aekl 

1 

traaa 

rea~aek2 

2 

traaa 

raa~aali3 

3 

traaa 

■ad~data 

5 

■tata 

S  ~ 

traaa 

rev_aak0 

0 

traaa 

rea~aakl 

1 

traaa 

roT^aoU 

2 

traaa 

r0r~aak3 

3 

traaa 

raT~aak4 

4 

traaa 

■Bd~data 

4 

atata 

4  ” 

traaa 

rea_aakQ 

0 

traaa 

raa~aekl 

1 

traaa 

raT~aak2 

2 

traaa 

rea~aak3 

3 

traaa 

4 

traaa 

rea~aekS 

S 

traaa 

■adTdata 

7 

■tata 

7  “ 

traaa 

reajaakO 

0 

traaa 

raT~aakl 

1 

traaa 

raa~aek2 

2 

traaa 

reT~aak3 

3 

traaa 

raT~aek4 

4 

traaa 

r«T~aakS 

S 

traaa 

reT~aakt 

4 

traaa 

■ad~data 

t 

■tata 

• 

traaa 

reT_aakO 

0 

traaa 

rea~aakl 

1 

traaa 

rer~aek2 

2 

traaa 

rev~aak3 

3 

traaa 

rar~aek4 

4 

traaa 

rea^aal^S 

S 

traaa 

roT~acik4 

4 

traaa 

rer~aek7 

7 

traaa 

■ad~data 

• 

■tata 

t  ~ 

traaa 

ra«'_aek0 

0 

traaa 

rea^aaU 

1 

traaa 

rea~aek2 

2 

traaa 

roa^aakS 

3 

traaa 

rea~aek4 

4 

traaa 

raa~aak5 

5 

traaa 

rea~aekt 

4 

traaa 

rea~aak7 

7 

traaa 

rOT~aek4 

4 

traaa 

■ad~data 

10 
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•tat*  10 
tcaaa  zaa_a«k0  0 
tzaaa  a«a~Mkl  1 
tcaaa  cev~aak2  2 
tcaaa  c<nr~aakS  3 
tcaaa  caaj*^*  * 
tcaaa  caT~aakS  S 
tcaaa  caa~aekC  C 
tcaaa  cea^aok?  7 
tcaaa  cec^aokO  0 
tcaaa  ce«’~ aakO  t 
aaaUaa  2~ 
atata  0 

tcaaa  cevjdata  1 
atata  1  ~ 
tcaaa  cac^data  2 
tcaaa  aa4~aah  0 

atata  2 

tcaaa  cetv_dBta  3 
tcaaa  aad^aek  0 
atata  3  ~ 
tcaaa  cev_data  4 
tcaaa  aadTaok  0 
atata  4  ~ 
tcaaa  caa_4ata  S 
tcaaa  aad~aek  0 
atata  S  ~ 
tcaaa  coa^data  C 
tcaaa  aad'ack  0 
atata  i  ~ 
tcaaa  cev_data  7 
tcaaa  aad_aak  0 
atata  7  ~ 
tcaaa  ca«_data  • 
tcaaa  aad^aok  0 
atata  • 

tcaaa  coa^data  t 
tcaaa  •ad''aak  0 
atata  •  “ 
tcaaa  caa_data  10 
tcaaa  •ad'aak  0 
atata  10  ~ 
tcaaa  aad_aak  0 
iaitlal  atata  0  0 
Clalali  ** 


Variable  Deflnitions 


with  nXT_XO;  us*  TBXT_XO; 
pscksq*  daflaltiens  is 

iiu*t_ef_Mehla*s  ;  oonstsnt  2; 
typ*  sasi_trsnsltlen_typ*  Is 

(sadjdsts,  se*_dats,  rev~sekO,  rav_sakl,  rav_*ak2,  ro«’_sek3,  rov_sek4, 

~  reT_sek5,  rev_sek€,  rev_sek7,  revjsekt,  re«'_*ak9,  snd_sak, uansad) ; 

typ*  bufter  typ*  Is  (dO,dl,d2,d3,d4.dS,d<,dT,dt,d9,*> ; 
psoksQ*  buf?_*nuBi_lo  is  n*w  *nua*rstion_lo  (baff*r_typ*)  ; 
us*  buff_*nuBi_lo;  ~ 

typ*  buff*r_*rrsy_typ*  is  srr*y(1..10)  of  buff*r_^typ*; 
typ*  s*^sxrsy_typ*  is  srrsy(1..10)  of  intogor  r«ag* 

typ*  Bwehin*l_stst*_typ*  is 
r*eord 

Sdst*  :buff*r_*rrsy_typ*  (d0,dl,d2,d3,d4,d5,d6,d7,dS,d9)  ; 
s*q  :  ittt*g*E  rsng*  0..10  :>  0; 
i  :int*g*r  rang*  1..10  1; 

*nd  r*cord; 

typ*  diissiy_typ*  is  rang*  1 . .  255 ; 

typ*  ataehin*2_atat*_typ*  is 
t*eord 

lldata:buff*r_typ*  *; 

*39  :int*gar  rang*  0..10  0; 

j  :int*g*E  rang*  i..X0  I; 

*nd  r*eord; 

typ*  aMahin*3_atat*_typ*  ia 
rseord  ~ 

damma  :  duswy^typ*; 
and  raeord;  ** 

typ*  ataobin*4_*tat*_typ*  is 
raoord  ~  “ 

duany  :  dussfy^typa; 
and  raeord;  ~ 

typ*  aaataln*5_stat*_typ*  ia 
raeord  ~ 

duanqr  :  ^'X'V.typ*; 

and  raoord; 

typ*  awohin*6_stat*_typ*  is 
raeord  ~  ~ 

dusaqf  :  duasy_typ*; 
and  raoord;  ~ 

typ*  aaeh 1 n*7_stat*_typ*  is 
raeord 

diwasy  :  duaay_typ*; 
and  raoord;  ~ 

typ*  Biaohin*8_stat*_typ*  is 
raeord  ~  ~ 

dusay  :  dua*qr_typ*; 
and  raoord;  ~ 

typ*  global_vari*bl*_typ*  is 
raeord  ~ 

DATA  :  buff*r_array_typ*  :>  (a,*,*,*,*. a, a, a. a, a) ; 

SBQ  :  **g_*rr*y_ty^  :■  (-1, -1, -1, -1, -1, -1, -1, -1, -1, -1) 

ACX  :  intagar  rsinga  -1..10  -1; 

and  raoord; 

and  dafinitions; 
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Predicate*action  Table 


Mtttrai; 

ia  eat  tzaaaltloa_etaak_paclta9a 


•epezate  (aala) 

pceoadon  aaaly«e_tradieatea_lltalilael  (legal  :  aechl  Bel_etate  type; 

~  ~  WTO— T;  pXebalj>azl^la_typa; 

•  :  aatarai;  ~  ~ 

«  :ia  eat  tzoaaltlea  etaek  a* 
te^pl  :  loteper  :>  abOML.acx  ♦  0;  ~ 

♦  ■opT  :  loteper  :•  (ebOPtL.aCK  *  1)  aed  11; 

te^l  :  ioteper  :•  (OIOltli.aCK  *  2)  aed  11; 

fpl  :  loteper  :>  (O&OBU.dCE  *  2)  aed  11; 

teopS  :  loteper  :•  (PTOPlTi.OCK  4  4)  aed  11; 

tai^  :  loteper  :•  (aXOMUi.aeK  4  S)  aed  11; 

teop?  :  loteper  :•  (01oau>.4CB  4  4)  aed  11; 

taoH  :  loteper  :•  (atdatL.aCR  4  7)  aed  11; 

te^a  :  loteper  :■  (OI<ai»fc.«CK  4  •)  aed  11; 

teoplO  ;  loteper  (OXOMIi.JteK  4  •)  aed  11; 


.oteek)  le 


loteper 


loteper 


bepla 

eaee  m  la 

ohea  0  •> 

If  (<aiiOHa..naxa(ieeai.i) 
aaak(w,aod  data); 
ead  If;  ~ 
ohoa  1  •> 

If  ((OlAaUi.DaZkdeeal.l) 
taidt(w,aBd  data); 
aad  If; 


K)  aad  (aLOWa..aKeaeeel.l)  -  -1))  thaa 


>  B)  ead  (aLOMa.BBQ (local.  1) 


If  ((taopl  •  local. aeq)  oi 
Booh («, reejBCkO) ; 

ead  If;  ~ 

ohoa  2  •> 

If  ((aiABU..DB>B(lecal.l) 
taah(a,aad  data); 

ood  If; 

If  ((taopl  e  local. oeq)  ai 
Boob (a, rcB_aakO) ; 

Mid  i£*  ^ 

If  ((t«ap2  e  local. oeq)  ei 
Baali(«,rc4  eekl); 

ead  If;  ~ 

afcoa  3  •> 

If  ((eLOBU.aBSB (local.  1) 
Baah(a,aDd  dote); 

ood  If; 


(eL01BI..3CK  /•  -1))  thaa 


-  B)  ood  (aLOaU.aBQ (local.  1) 


(OIABU.aCK  />  -D)  tlMa 


(ax«BKi..acB  />  -1))  tkaa 


B)  ead  (QUjBBL.BBQ (local.  1)  -  •!))  thaa 


If  ((toovl  •  local. aeq)  a 
Baah(w,re4  aekO) ; 
ood  If; 

If  ((taap2  -  local. oeq)  a 
Baab(w,rev  eekl)  ; 
ood  If; 

If  ((toa^S  •  local. oeq)  a 
Baah(w,rav  aok2)  ; 
ood  If; 
ahao  4  a> 

If  ((aiOaU>.OBXB(loael.l) 
Boah («, aad  data) ; 
aad  If;  ~ 


(OLOaU.kCK  />  -1))  thaa 


aad  (OMBU.aCB  /•  >1))  thaa 


(8IAaU>.aCK  /•  -1))  tiMa 


-  B)  aad  (GLOBAL. BBQ (local. 1) 


If  ((taopl  e  local. oeq) 
Baah(w,rer  aokO) ; 
aad  If; 

If  ((taap2  •  leoal.aoq) 
Booh («, reo  aekl) ; 
aad  If; 


(GLOBBL.ACB  /e  -1))  tboe 


(OLOBkL.aCB  /m  -D)  thaa 
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If  ((taapi  >  leoal.M^  ud  {QUMKL.MCK  /•  -1))  tksB 
(w,  rov  aakf)  ; 

•ad  if; 

if  ((t«aH  -  leoal.Mq)  and  (ODMnii.acS  />  >l)t  thaa 
ta^(«,cav  aakS); 
aad  if; 
whaa  S  ^ 

if  ((eLOUa.DUrAaeoal.i)  -  B)  aad  (aLOMa.nQdoaal.i)  -  -D)  thaa 
BaA  (w,  aadjdata) ; 
aad  if;  ~ 

if  ((taa^l  •  laoal.aaq)  aad  («lf<nB»T  .BCK  /•  '1)1  tkaa 
Baah (a, rov  aokO) ; 
aad  if;  ~ 

if  ((taapf  •  laoal.aaq)  aad  ((HiOBBL.BCK  /■  -1))  tkaa 
ta^  (a,  aea  aokl)  ; 
aad  if;  ~ 

if  ((taapB  a  laoal.aaq)  aad  (aLOMH.BCK  /—  -1))  thaa 
taA  (a,  rea  aek2)  ; 
aad  if; 

if  ((toi^  a  laoal.aaq)  aad  (OXiOaBL.Bac  /a  -I))  tiMa 
>a^(a,roa  aokl)  ; 
aad  if;  ~ 

if  ((toapS  a  laoal.aaq)  aad  (aUMXi.kCX  /a  -1))  kiMa 
Book (a, raw  aok4) ; 
aad  if; 
ahaa  C  a> 

if  ((SLaHa.DkXKlooal.i)  a  B)  aad  (6L0BkL.BBQ(looal.i)  a  -l))  thaa 
Boak (a, aad  data) ; 
aad  if; 

if  ((ta^l  a  laoal.aaq)  aad  (SLOBkL.kCX  /a  -1))  thaa 
Buah (a, rea  aekO) ; 
aad  if;  ~ 

if  ((toavl  a  laoal.aaq)  aad  (aLOBU..AieB  /a  -1))  tltaa 
Ba^  (a,  revjBOfcl) ; 
aad  if;  ~ 

if  (<ta^l  a  laoal.aaq)  aad  (QLOBkL.kCB  /a  -1))  tltaa 
Baak(a,rev  aokl)  ; 
aad  if;  ~ 

if  ((toapd  a  laoal.aaq)  aad  (aMBItt.kCB  /a  -1))  thaa 
Boak (a, rea  aokl); 
aad  if; 

if  ((taapS  a  laoal.aaq)  aad  (auBkl.ACB  /a  -i))  thaa 
BuA  (a.  rev  aekd) ; 
aad  if;  ^ 

if  ((toapB  a  laoal.aaq)  aad  (SMBhL.kCB  /a  -1))  thaa 
Bo^  (a,  rev  aekS)  ; 
aad  if; 
ahaa  7 

if  ((eLaBkL.DaXk(looal.i)  a  E)  aad  (eXAakL.SBQdoaal.i)  a  -1))  t)Me 
Baah(a,aBd  data); 
aad  if; 

if  ((taapl  a  laoal.aaq)  aad  (abOBhL.kCK  /a  -i))  tiMa 
Baah  (a,  rev  aokO)  ; 
aad  if;  ~ 

if  ((toapl  a  looal.aaq)  aad  (OLOBhL.hCK  /a  -l))  thaa 
BaA(v,rov  aokl)  ; 
aad  if;  ~ 

if  ((taapl  a  laoal.aaq)  aad  (SUNML.kCK  /a  -i))  thaa 
Baah(v,rev  aokl)  ; 
aad  if;  ~ 

if  ((taapd  a  looal.aaq)  aad  (QLOBkL.kCB  /a  -i))  tiMa 
Buah  (w,  rev  aeld) ; 
aad  if;  ~ 

if  ((taapS  a  looal.aaq)  aad  (QLOBkL.kCB  /-  -1))  thaa 
Baah(«,rev  aokf)  ; 
aad  if; 

if  ((taapd  a  looal.aaq)  aad  (QLOBkL.kCB  /a  -l))  thaa 
Baah(«,rev  aokS)  ; 
aad  if;  ~ 

if  ((taap7  a  looal.aaq)  aad  (QLOBkL.kCB  /a  -i))  tlwa 
Ba^  (w,  rov  aekd)  ; 
aad  if; 
whaa  t 

if  ((QLOBkL.OBTkdooal.i)  a  t)  aad  (OLOBkL.SBO(loeal.i)  a  -1))  thaa 
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raah(w,Mid  4Bta); 

t<;  ~ 

if  ((t«vl  ■  loaal.aaq)  aad  (OMU.AeK  /-  -I))  tkas 
*«ah<«,cav  aokO); 
aad  If;  ~ 

If  <(taBp2  ■  looal.saq)  aad  <aLeUL.kiCR  />  -1))  tkaa 
taak(«,raa  aakl)  ; 
aad  it;  ~ 

it  ((till  >  local. aaq)  aad  (OLOBU.acx  /•  -1))  tkaa 
taah (w, raajaakf) ; 
cad  If;  “ 

if  ((til  ■  local. ccq)  aad  (aLOaat..JkCX  /•  -1))  tkaa 
laah(«,aaa  aak3) ; 
cad  if;  ~ 

if  ((tcivS  •  local. caq)  aad  (aLOUL.acK  /•  -ll)  thaa 
fuah(w,Mv  ackd)  ; 
cad  if;  ~ 

if  ((tai*  c  local. ac4)  aad  (flOiOUL.keR  /•  -1))  tkoa 
VBah(w,aoc  ackS); 
cad  if; 

if  ((tl7  -  local. ccq)  aad  (naaaL.MCK  /•  -1))  thaa 
Vaah(w,rav  ackd); 
cad  it; 

it  ((tcaph  -  local. aaq)  aad  (aLaMa.hCX  />  -1))  thaa 
Vaah(«,ra*_aak7) ; 
cad  if;  ~ 

ahca  S  •> 

if  ((OLaahL.DhlAdccal.i)  >  t)  aad  (eLOBhl..na (local. i)  >  -1))  thaa 
taah(«,aad  data)  ; 
aad  if;  ~ 

if  ((til  -  local. aoq)  aad  (OLOUL.AeK  /•  -1))  thaa 
taah(a,rcv  adiO) ; 
aad  if;  ~ 

if  ((taap2  a  local. 004)  aad  (OLaui,.hCK  /•  -1))  thaa 
taah(«,rea  aekl) ; 
cad  it;  ~ 

it  ((taapS  -  10001.004)  aad  (auaM..hiCK  />  -1))  thaa 
taah(w,s'av  achS) ; 
aad  it;  ~ 

if  ((ta^M  -  local. 004)  aad  (aLOUi;,.«iCR  /-  -1))  thaa 
raoh  (w,  row  ackf) ; 
cad  it; 

it  ((taavS  a  local. 004)  aad  (OUkL.ACK  /a  -1))  thaa 
rooh («, ra*_aak4) ; 
aad  it;  ~ 

it  ((toopd  a  loaal.ao4)  aad  (eLOML.JkOC  /•  -1))  thaa 
raah(«,raa  ackS) ; 
aad  it;  ~ 

it  ((tl7  a  local. 004)  aad  (8LaMI,.kCK  /a  •!))  thaa 
rook (w, rev  ackd) ; 
aad  if;  ~ 

if  ((tooiM  a  local. 004)  aad  (OUUL.hCX  /a  -1))  thaa 
Voah («, raT_aak7) ; 
aad  it;  ~ 

it  ((tl*  a  10001.004)  aad  (OMUL.hCX  />  -1))  thaa 
Vaak(«,reo_ackd) ; 

Mid  Idr 

it  ((tiio  a  local. 004)  and  (OUakL.hex  /•  •!))  thaa 
Vaoh («, rev  ackd) ; 
aad  if; 

chaa  10  a> 

if  ((taopl  a  10001.004)  aad  (OUML.hCX  /a  -1))  thaa 
Vaoh («, rcvjaokO) ; 
cad  if;  ~ 

if  ((tl2  a  10001.004)  aad  (OLOUL.hOB  /a  •!))  thaa 

took («, ccvjiakl) ; 
aad  if;  ~ 

if  ((toopS  a  10001.004)  aad  (OLauL.heX  -1))  thaa 
tooh («, rev  aak2) ; 
aad  if;  “ 

if  ((t1«  a  10001.004)  aad  (OLOML.hCX  /-  -1))  thoa 

took («, rev  aekS) ; 

^md  ^  d  * 

if  ((taovs  a  local. 004)  aad  (aLOML.hiCS  /a  -1))  thaa 
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(abOML.ACK  /-  -1))  tkM 


tnak(«,rav  aak4) ; 

•ad  if; 

if  ((tMr<  -  looal. aaq)  ud 
Va«h(«,cav  aokS); 

•ad  if; 

if  ((taap?  ■  laoal.aaq)  aad  (OiOBkli.dac  /■  -1))  than 
Vo^  (w,  rov  ackd)  ; 

•ad  if; 

if  ((ta^  -  loMl.aaq)  aad  (OLaua.aCX  /•  -1))  thM 
Vaah(it,cav  aak7); 

•ad  if; 

if  ((taap*  -  lewl.aaq)  aad  (au)adl..JkiCX  /-  -1))  than 
taah(w,raa  ackd)  ; 

•ad  if; 

if  ((ta^lO  «  leoal.aaq)  aad  (axodkli.JieK  />  -1))  than 
taA(v,ra<r  ackd); 

•ad  if; 

vhaa  ethaca  •> 

Ball; 

•ad  ••••; 

•ad  kBalyB*_dradlaataa_llBaklaal; 


acparata  ^oia) 

pzocMdan  kaalyBB_d»adioBtaa_llirhlBaT  (loeal  :  aanhtaaf  akatajtypa; 

~  ~  OLOkkL:  9lobal_aaAabla3lpa> 

a:  aatocal;  ~ 

w  :1a  aot  tzaaaltlea_ataek_paekaga.ataek)  ia 
bagia  ~ 

eaaa  a  ia 

wkaa  0  ■» 

if  ((aU»kI..IMkSk(lecal. j)/-k)  aad  (eLam..dBQ<l«eal. j>  >  looal. aap))  tkaa 
taak(w,taa  data) ; 

•ad  if; 

•hra  l|2|3|4|5|f|7|S|d  ■* 

if  (aLOdkL.BdXk(loeal.l)od)  than 
daah(«, aad  aek); 

•ad  if;  ~ 

if  ((aLOMX..DdSk(looal. j)/>B)  aad  (aX>aaU..adQ(looal. j)  O  local. aap))  tkaa 
took  (m,  cc*  data) ; 

•ad  if;  ~ 

•baa  10  o> 

if  (siAakL.nkndocai. j)>k)  tiwa 
daab(v, aad  aek); 

•ad  if; 

•baa  otbata  •> 
aall; 

•ad  eaaa; 

•ad  baalyaaJgadioataaJManhIna?; 


acparata  (aaia) 

prooadara  kaalyaa_>»adicatoa_llantilnal  (local  :  aanhl  nat  atatajtypa; 

~  ~  OLOMIi;  glebal_taAablo3)rpa> 

a  :  aatocal;  ~  ~ 

•  ;  ia  oat  txaaaitiea_ataak_paekago . otaek)  ia 


bagia 

aall; 

•ad  baalyaaJcadicataaJMicblnal; 


acparata  (aaia) 

pcocadoca  kaalyn_rradiaataa_Maobiaa4  (loeal  :  aael^aad  atatajtypa; 

~  ~  OltfdbL:  globaljvoAabla^ypo; 

a  ;  aatocal;  ~  ~ 

«  :  ia  oat  tcaBaitioa_ataek _packaga . atack)  ia 


bagia 

aall; 

•ad  kBalyaa_dradicataa_lliehina4; 


acpocata  (aaia) 

pcocadoca  daalyia_dc»dieatoa_lti  nliiaoS  (local  :  aachiaoS  atato  typo; 

~  ~  ObOlU:  global_caAablojEypo> 

a  :  aatocal;  ~  ~ 

w  ;  la  oot  tcaaaitiea_ataek_paokaga . atack)  ia 


bagia 

aall; 

•ad  ABalyao_Pcadleataa_Maaklaa5; 
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■ijTiif  (Min) 

pioaadan  Jkaalyaa  fsadtoatM  MiohiaaC  (local  :  aaolil— €  atafca  typo; 

SUML:  «lafaalj*a«ltfkla3yp*; 

o  :  aatocal;  ~  ~ 

w  :  ia  cot  taaaattlaa_ataafc_paofcagB .ataafc)  la 


bagla 

aoll; 

aad  ABalyaa_.tca4iaBtaa_lbaUM<; 


■oparata  ^ia) 

pceoadoiM  aaaly«a_t«adloataa_llidilBa7  (looal  :  aaolilaa?  afeatajtypa; 

OXMUi:  global_'*a]SLabla3yP*> 

m  :  aatoral;  ~ 

•  :  la  oat 

txaaattloB_otaek_paflkago.ataak)  la 


bagla 

Ball; 

aad  Aaalyaa  rzadloataa  Md^aa?; 


■oparata  ^mIb) 

prooadoxa  AaalyMi_Pzadlaataa_lltalklaaa(loaal  :  ■aablao*_atata_typa; 

~  ~  OTiOMUi:  global_aa^abla3yp*; 

o  :  aatoral;  ~  ~ 

«  :  la  oat  traaaltloa_ataak_paakaga . otaek)  lo 


bagla 

aoll; 

aad  Aaalyia_»Badloataa_lli  nhlaat  ; 


oaparata  bula) 

pro oa data  Aotlea(la_ayataa_atata 
la3<*Btiblaa 
out^ayot'  aoi_otata 


la  oat  aatata_raaord_typa; 
la  oat  aoBJtcuMltloi^typa; 
la  oat  aatato_raoozd_typa)  la 


bagla 

oaoa  (lB_traaaltloa)  lo 
«bm  ?ad_doto  ■> 

oat_ay«taa_atato.abaMI.  V]UUUUnJM.D»za(la_ayataa  atata.Mi^aal_atata.l)  ;a 
la 'ayotaa  otata.aaohlaal  atata.Sdata(la  ayotaa  oEata.qaahlaal  otata.l); 
aat^ayata^atata.eu>abIi_^uaABIM.nQ(la_ayata^atato.aaablaar  otata.l)  ;« 

”  ~  ~  ~  lB_iyata»_atata.aan'litB^l_atato.aag; 

oat_ayat«ai_atato.aaablBal_atato.l  :•  (la  ayataa_atato.aaablaal  otata.l  aod  10)  o  1; 
oat_ayataa3t«ta.Baoblaal3^^*'*«4  :■*  (T(la_ayiftaB_atata.Baabraal_atata.aag)  4  l)aed  11); 

vbaa  raa_aak0  |  rerjoakl  |  rerjoekl  |  ceT_adc3  |  Be«'_aak4 

I  rev_aak9  |raa_aak<  |  x^_aok7  |raT_aekO  jroa_a«^*  ^ 

OBt_ayataa_atato . gMMttJWUgabIKl . *CK  :•  -l; 

abaa  aad_aok  •> 

aat_ayataB_atata.aboaUijaUMUO.JueK  :•  lB_ayataB_atata.Baablao2_atato.a8p; 
oat~ayataB~atato.aaahlaa2_atato.Kdata  :>  a;”  ~  ~ 

vbaa  coT_data  •> 

eat  oyotoB  atata.Banhlna2  otato.Kdata 

la~ayf  _f  ta . ueaU_V>0II>KM0 .IMaA(lB_ayataB_Btata . aacbiaal  otata.j); 
eat  ayataB~ atata .CIOKU  VMIMUl . DM* (la  ayot«r'atata .MeblBa2  atata.3)  >• 
oat~ay etaBTotata  ■  ObOBUJOU MUO .  OKQ  (lB3ayataB~Btata.Baeblaa2~atBto.5)  -1: 
OBt~ayataB3tata.Ba«ihliB2_atato.  j  :•  (lB_ayat aB_atata . bb nh t BaT_atata ■  j  Bed  10)  4  1; 
oat_ayataB_atata.Baehlaa2~atata.a8p  :>  ( ( (lB_ayatM_atBta.aaehlBa2_atata.aM)  l)BDd  11); 
wbaa  etbara  ■>  ~  ~  ~  ~ 

,llBa(*Tbara  la  oa  axror  la  tha  Jketloa  preoadoxa’) ; 
aad  eaaa;~ 
aad  JUBloa; 
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Output  Format 


MparAt*  (Min) 

preoadux*  eutputjBtupla  (tiqpla  :  In  out  aatata_xaeexd_tppa)  la 
bagin 

If  prlat_taaadar  than 
naa_llna (2) ; 
aat_eol (7) ; 

aO. (aaq.  i,  Sdata) ,  a2  (axp,  j^Sdata) ,  (I>AXh,«IQ,haC)  ■•)  ; 
pclntjhaadar  :■  falaa; 

alaa  ~ 

put("  I"  4  lntagar'iMga<tiipla.Mehlna_atata(l) )  ); 
pat(-  ,  -); 

put(tupla.Mehlnal_atata.aaq,  width  k>  i); 
put("  ,  “); 

pat(tupla.Mehlaal_atata.l,  width  *>  1)  ; 
put("  ,  "); 

buf  f_anua_lo  .put  (tupla  .M<fl>laal_atata .  Sdata  (1) ,  aat  »  iqipar_oaaa)  ; 

putC  4  Intagar'laMga  (tupla  .Mflhlaa  atata(2))  ); 

pat("  ,  ");  “ 

put  (tupla .Mahlna2_atata.aap,  width  «>  1); 

put(-  .  “); 

put (tupla. Mahlna2_atata.j,  width  ->  1) ; 
put("  ,  "); 

^®f_*nua_lo. put  (tupla. Mohina2_atata.Rdata,  aat  ■>  uppar_eaaa) ; 
fox  1  in  1 . . 10  loop  ~ 

put("  ,  "); 

buff_anuai_lo. pot  (tupla. G1.0BAL_VWlhBl<BS.DM&(l),  aat  »  uppax  oaaa) 
put  (“,“), • 

put  (tupla  .GliOBUi_VMahBLBS .  SBQ  (1)  ,  width->l)  ; 
and  loop;  ~ 

putC 

put  (tupla.  Gixnu.  VMUABLBS.ACK,  width  »  1); 
pot("  )"); 
and  If; 

and  output jetupla; 
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Program  Output  (System  State  Analysis) 
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aad~aek 

120 

135 

10,  1 

] 

3 

Ea«’_aak9 

41 

cevjdata 

158 

134 

9,  2 

1 

1 

re«’_aak8 

42 

af>d_data 

158 

reT~data 

159 

137 

8,  3 

] 

1 

rav~aak7 

43 

and^^ta 

159 

rav~data 

140 

138 

7,  4 

] 

1 

reT~aak4 

44 

aodjdata 

140 

rev~data 

141 

139 

4,  5 

3 

1 

rov~aak5 

45 

aad~data 

141 

aad_aek 

120 

140 

10.  4 

3 

0 

xev_data 

142 

141 

9.  5 

3 

0 

andTdata 

142 

rovTdata 

143 

142 

8,  4 

3 

0 

and~data 

143 

rcv~data 

144 

143 

7.  7 

] 

0 

and_data 

144 

snd_aek 

145 

144 

7,  0 

3 

4 

rev~aakl 

1 

and~data 

144 

rcv~data 

147 

145 

8,  0 

3 

4 

rov~aelc3 

4 

and_data 

148 

rev^lata 

149 

144 

7.  1 

3 

5 

rov^aoU 

5 

and~data 

149 

rov^Uta 

170 

147 

9,  0 

3 

4 

rov“aek5 

11 

andjdata 

171 

rev~data 

172 

148 

8,  1 

1 

4 

rov“aok4 

12 

aod~data 

172 

rcv^data 

173 

149 

7,  2 

3 

4 

rov~aok3 

13 

and~data 

173 

revjdata 

174 

150 

10,  0 

3 

4 

rov_ack7 

24 

rcv_data 

175 

151 

9.  1 

3 

4 

rav~ack4 

25 

and_data 

175 

revjdata 

174 

152 

8,  2 

3 

3 

rav_aak5 

24 

and~data 

174 

rev_data 

177 

153 

7,  3 

3 

3 

rev_aeli4 

27 

sad~data 

177 

rov~data 

178 

154 

10,  1 

3 

4 

rcv_ack8 

44 

rov~data 

179 

155 

9,  2 

3 

2 

rcv”aok7 

47 

snd_data 

179 

rev^^ta 

180 

154 

8,  3 

3 

2 

rev~aek4 

48 

andjdata 

180 

rav~data 

181 

157 

7,  4 

3 

2 

rov~aok5 

49 

and_data 

181 

rav~data 

182 

158 

10,  2 

3 

2 

rov“aok9 

77 

revjdata 

183 

159 

9,  3 

3 

1 

rev~aek8 

78 

andT data 

183 

95 


1(0  t  •>  4  ]  1 


1(1  (  7,  S  ]  1 

1(2  (10,  5  ]  0 

1(3  [  9,  (  ]  0 

1(4  (  •,  7  }  0 

1(5  t  7.  0  ]  7 

1((  [  8,  0  ]  7 

1(7  t  7.  1  ]  ( 

1(8  (  9.  0  ]  7 

1(9  [  8,  1  1  5 

170  (  7,  2  1  5 

171  tlO,  0  ]  7 

172  t  9,  1  ]  5 

173  (  8,  2  }  4 

174  (  7,  3  1  4 

175  tlO,  1  ]  5 

17(  (  9,  2  ]  3 

177  t  8,  3  ]  3 

178  (  7,  4  ]  3 

179  {10,  2  ]  3 

ISO  (  9,  3  ]  2 

181  (  8,  4  ]  2 

182  (  7,  5  ]  2 

183  (10,  3  1  1 

184  (  9,  4  ]  1 

185  [  8,  5  ]  1 

18(  [  7,  (  ]  1 


revjdata  184 
reV~ mIi7  79 
•ndTdat*  184 
185 

xev~ aekS  80 
M>d~d«t«  185 
rer  <Ut«  18( 
reV~dat«  187 
•nd~dat«  187 
rev~dat«  188 
•ad_data  188 
rcv~dAta  189 
rev~aak0  0 
and_data  190 
rev~ aak2  2 
aad]data  191 
rav_data  192 
rov~aakl  3 
and~data  192 
andfaak  1(5 
reW“ aak4  7 
andjlata  193 
rovjdata  194 
rav~aa3c3  8 
andjdata  194 
rav~data  195 
re«’~ aek2  9 
ancTdata  195 
and'aok  1(5 
rev_aek(  17 
rov~ data  19( 
rov~aokS  18 
aiid~data  19( 
rev~ data  197 
rev~ aek4  19 
and~data  197 
rovj4*ta  198 
rcV~ a<di3  20 
andTdata  198 
and~aok  1(5 
rov~ aok7  35 
rov'data  199 
rev~ aak(  3( 
and2]d«ta  199 
rcv~data  200 
rov~aak5  37 
andjdata  200 
rev~data  201 
rov~aek4  38 
andjdata  201 
and~a^  145 
rav~ack8  (2 
rov~data  202 
rcvjack7  (3 
and~data  202 
rev~data  203 
rev~aek(  (4 
aml~data  203 
ray~data  204 
rov~ aek5  (5 
and~data  204 
and~ aek  1(5 
rov~a<>k9  97 
revjdata  205 
rav~aakS  98 
and~data  205 
rev~ data  20( 
rav~aak7  99 
aad~data  20( 
revjdata  207 
rovjaokS  100 
andTdata  207 
and'aok  1(5 
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lt7 

tlO,  6 

1 

0 

rev_dat« 

208 

9,  7 

] 

0 

■iid~data 

208 

re«'_data 

209 

109 

8,  8 

] 

0 

•ndjdata 

209 

•nd_«ak 

210 

190 

8,  0 

) 

8 

rav~aakl 

1 

•Bd~data 

211 

rav~dat* 

212 

191 

9,  0 

] 

8 

rev~Aek3 

4 

•iid_<Ut« 

213 

rov~d*t« 

214 

192 

8,  1 

1 

6 

rev~aak2 

5 

214 

215 

193 

o 

H 

] 

8 

rev~*ak5 

11 

rev_dat* 

216 

194 

[ 

9,  1 

] 

6 

rev_aale4 

12 

•iid~dat« 

216 

rev~dat« 

217 

195 

l 

8.  2 

1 

5 

rev_aeU 

13 

•aid~dAt« 

217 

rav~d«ta 

218 

196 

no,  1 

] 

6 

rav~aek6 

25 

rev_data 

219 

197 

[ 

9.  2 

] 

4 

rav~aak5 

26 

■nd_dat« 

219 

rovjdata 

220 

198 

t 

8,  3 

1 

4 

rav~aek4 

27 

•ad_data 

220 

rav~data 

221 

199 

[10.  2 

1 

4 

rev_aek7 

47 

rav_dat« 

222 

200 

I 

9,  3 

] 

3 

rev~aek6 

48 

and~data 

222 

revjdata 

223 

201 

[ 

8,  4 

] 

3 

rav~ack3 

49 

and~data 

223 

rav~data 

224 

202 

(10,  3 

] 

2 

rev^aekO 

78 

rav~data 

225 

203 

t 

9,  4 

] 

2 

rov“aok7 

79 

and~d*ta 

225 

rcsv~data 

226 

204 

( 

8,  5 

] 

2 

rev_aak6 

80 

and~data 

226 

rar~data 

227 

205 

[10,  4 

1 

1 

rov~aok9 

117 

rev_data 

228 

206 

[ 

lf> 

] 

1 

roT_aok8 

118 

aad_data 

228 

Eav_data 

229 

207 

( 

8,  6 

] 

1 

Eoir_ack7 

119 

snd~data 

229 

rcv~data 

230 

200 

[10,  7 

] 

0 

rev_data 

231 

209 

[ 

9,  8 

) 

0 

snd_data 

231 

rev_data 

232 

210 

[ 

8,  0 

1 

9 

rav_aak0 

0 

and~data 

233 

211 

[ 

9.  0 

] 

9 

rev_aek2 

2 

aiid_data 

234 

rov^data 

235 

212 

[ 

8,  1 

1 

7 

rev_aekl 

3 

snd_data 

235 

and_aalc 

210 

213 

[10,  0 

] 

9 

rev_aek4 

7 

rav~data 

236 

214 

[ 

9.  1 

] 

7 

rov“aok3 

8 

andjdata 

236 

rev_data 

237 

215 

[ 

8,  2 

] 

6 

rov~aak2 

9 

ind_data  237 
ind  aok  210 


97 


21C  [10,  1 
217  (  »,  2 

210  t  •,  3 

219  (10,  2 

220  [  9,  3 

221  [  0,  4 

222  [10,  3 

223  [  9,  4 

224  [  a,  S 

225  [10,  4 

226  [  9,  5 

227  [  a,  6 
22a  [10,  5 

229  [  9,  6 

230  [  a,  7 

231  [10,  a 

232  [  9,  9 

233  [  9,  0 

234  [10,  0 

235  [  9,  1 

236  :i3,  1 

237  [  9,  2 

230  [10,  2 

239  [  9,  3 

240  [10,  3 

241  [  9,  4 

242  [10,  4 

243  [  9,  5 


7 

5 

5 

5 

4 

4 

3 

3 

3 

2 

2 

2 

1 

1 

1 

0 

0 

10 

10 


rav_aakS  10 
raT_d«ta  230 
ccV~ «ek4  19 
•iid~dat«  230 
revjdAta  239 
reV~ aek3  20 
■ad~d*ta  239 
•ad~aok  210 
rav~«ek6  36 
rev~data  240 
rov~aok5  37 
•adjdata  240 
reif~data  241 
reV~ aek4  30 
•adjdata  241 
•ad~«ak  210 
rov_aak7  63 
rev^^ta  242 
raV~ aak6  64 
and~data  242 
raT~data  243 
r<nr~ aak3  65 
and~data  243 
and~aak  210 
rav~ aekO  90 
rav~data  244 
rov“aok7  99 
andjdata  244 
rev~data  245 
rav~aok6  100 
andjdata  245 
and~aak  210 
ro«_aak9  141 
rov~ data  246 
rav~aalia  142 
and~data  246 
rev" data  247 
rov" acle7  143 
and~data  247 
aad~aok  210 
rev** data  240 
aad''data  240 
and"aok  249 
rev~aekl  1 
andjdata  250 
rev~data  231 
rev~aek3  4 
rev_data  252 
rev~aeli2  5 
and~data  252 
rev~data  253 
rov~aok4  17 
rev~data  254 
rev~aek3  13 
aad_data  254 
rov~data  255 
rev2aok5  26 
rev^data  256 
rov_aok4  27 
and~data  256 
rev"data  257 
rev~aek6  40 
rovjdata  250 
rev" aak5  49 
aad~data  250 
rov~data  259 
rov~aoli7  79 
rev~data  260 
rev~aek6  00 
and~data  260 
rev~data  261 
rev~ aokO  110 


244 


10,  5 


2 


245 

I  « 

2 

rw_aok7 

119 

•nd~dat* 

262 

rev~dat4 

263 

246 

no.  6 

1 

rov_aok9 

163 

reT~d4t4 

264 

247 

[  ».  7 

1 

ro«’~4ek8 

164 

M>d~d4t« 

264 

revjdat* 

265 

24S 

[10,  9 

0 

reT~d4t4 

266 

249 

t  »,  0 

11 

reVj4^9 

0 

4ndjd4t4 

267 

250 

[10.  0 

11 

raT~4ek2 

2 

rev~d4t4 

268 

251 

[  9,  1 

9 

rev_4akl 

3 

4IMl_d4t4 

268 

4nd~4ek 

249 

252 

[10,  1 

9 

rev_4ak3 

8 

rev~d4t4 

269 

253 

[  9.  2 

7 

rav~4ak2 

9 

4nd_d4t4 

269 

4nd~4ak 

249 

254 

[10,  2 

7 

reT~4ak4 

19 

raT_d4t4 

270 

255 

[  9,  3 

6 

rav~4«k3 

20 

snd~d&t4 

270 

4nd_4ok 

249 

256 

[10.  3 

5 

rev_4ok5 

37 

271 

257 

[  9,  4 

5 

rev~4ok4 

38 

and_d4t4 

271 

and~4ek 

249 

258 

[10,  4 

4 

rev~4eli6 

64 

re«’~d4t4 

272 

259 

[  9.  5 

4 

rev~4ekS 

65 

and_d4t4 

272 

and_4ak 

249 

260 

[10,  5 

3 

re»“4ok7 

99 

rev~d4t4 

273 

261 

[  9,  6 

3 

rev~4ak6 

100 

aad~d4t4 

273 

and~4Ck 

249 

262 

[10,  6 

2 

rev~4ek8 

142 

rov~d4t4 

274 

263 

[  9,  7 

2 

rov“4ok7 

143 

and~d4ta 

274 

snd~4ek 

249 

264 

[10,  7 

1 

rov~4ck9 

188 

rav~d4t4 

275 

265 

[  9,  8 

1 

rcv_4ck8 

189 

snd_d4t4 

275 

and~4ek 

249 

266 

[10,10 

0 

snd~4eli 

276 

267 

[10,  0 

12 

reT~4ckl 

1 

raTjd4t4 

277 

268 

[10,  1 

10 

rcv~4ck2 

5 

raT~d4t4 

278 

269 

[10,  2 

8 

rev_4ak3 

13 

rov_data 

279 

270 

[10,  3 

6 

*OT~40k4 

27 

reTjd4t4 

280 

271 

[10,  4 

5 

49 

roT~d4t4 

281 

272 

[10,  5 

4 

rav_4ek6 

80 

rov~^ta 

282 

273 

[10,  6 

3 

rov_4ok7 

119 

raY_d4t4 

283 

274 

[10,  7 

2 

rey“4ck8 

164 

roy~d4t4 

284 

275 

[10.  8 

1 

rev~4ak9 

209 

reT_d4t4 

285 

276 

[10,  0 

13 

rov_4ak0 

0 

277 

[10,  1 

11 

rev~4akl 

3 

snd~ 4alc 

276 

99 


27« 

[10. 

2  J  9 

ra«’_ae>t2 

9 

aiid~aek 

279 

279 

txo. 

3  ]  7 

roo~aali3 

20 

aiid~aak 

279 

290 

[10, 

4  1  < 

reo~aek4 

39 

aad~aek 

279 

29'' 

'10. 

5  ]  5 

reo~aekS 

9S 

aad_aak 

279 

42 

no. 

«  ]  4 

rov_aekC 

100 

aiid_aek 

279 

293 

no. 

7  ]  3 

reo~aek7 

143 

aad~aek 

279 

294 

no. 

9  ]  2 

rev~aak9 

199 

aad~aak 

279 

295 

no. 

9  1  1 

roT~aok*' 

232 

andTaok 

279 

soMORT  or  manaaiLiTT  joultsis  <Mua.Tsxs  cowlbtbo) 


tfuater  of  otatoa  gonoratod  :2tC 
NuidMr  of  atatoa  aaalysod  :2tC 
Vuater  of  daadlooka  :  0 

onxxcono  nuMsxTXOMS 
•***nK)iit***** 
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APPENDIX  C  ( TiAm  Bus  Protocol  ) 


FSM  Text  File 


•tart 

iraab«r_of_aaahlMa  • 
■afihina  1 

atata  0 

traas  revl  1 
trana  9at  tkl  2 

atata  1 

trana  raadyl  0 

atata  2 

trana  Saltl  3 
trana  paaal  0 

atata  3 

trana  anraDl  2 
trana  paaa_tkl  0 
■arhlna  2 
atata  0 
trana  rev2  1 
trana  gat  tk2  2 
atata  1  ~ 

trana  raady2  0 
atata  2 
trana  )tailt2  3 
trana  paaa2  0 
atata  3 

trana  aMra02  2 
trana  paaa_tk2  0 
naetaina  3  ~ 

atata  0 

trana  re<r3  1 
trana  gat  tk3  2 

atata  1 

trana  raady3  0 

atata  2 

trana  Xnlt3  3 
trana  paaa3  0 

atata  3 

trana  a»ra03  2 
trana  paaa_tk3  0 
awehina  4  ~ 

atata  0 

trana  rev4  1 
trana  gat  tk4  2 
atata  1  ~ 

trana  raady4  0 

atata  2 

trana  Xnit4  3 

trana  paaa4  0 
atata  3 

trana  a»raD4  2 
trana  paaa_tk4  0 
awohlna  S 

atata  0 

trana  rcvS  1 
trana  gat_tkS  2 
atata  1  ~ 
trana  raadyS  0 

atata  2 

trana  XnltS  3 
trana  paaaS  0 
atata  3 
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tr«n*  aoMOS  2 
traiM  pMa_tk5  0 
—China  6  ~ 

atata  0 

traaa  revC  1 
trana  9at_tk6  2 

atata  1 

traaa  raadyC  0 

atata  2 

traaa  SaltC  3 
traaa  paaa6  0 
atata  3 

traaa  a»ra06  2 
traaa  paaa_tkC  0 
awohiaa  7 

atata  0 

traaa  rov7  1 
traaa  9at_tk7  2 

atata  1 

traaa  raady7  0 

atata  2 

traaa  aBlt7  3 
traaa  paaa7  0 

atata  3 

traaa  MoraD7  2 
traaa  paaa_tk7  0 
awebtaa  • 

atata  0 

traaa  rovS  1 
traaa  ^at  tkS  2 
atata  1  ~ 

traaa  raadyt  0 
atata  2 
trana  XaltS  3 
trana  paaaS  0 
atata  3 

trana  aeraOS  2 
traaa  paaa_tk8  0 
inlelal_atata  00000000 
finlab 
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Variable  Definitions  (No  Message  in  Variables) 

with  nxx_10;  UM  nXT_XO; 

paekag*  teflnltlena  la 

aua>_of_aachtnaa  :  eonatant  •; 

k  :  eeaataat  :■  7;  —  nuabar  ot  rowa  (aaaaavaa)  la  output  buffor 
tppo  aaa_traaaltloa_t5po  la  (paaal,paaa2,paaa3,  paaa4,paaaS,paaaC, 

paaal , paaat , gatjtkl, 9at_tk2 , 

9ot_tk3,9at  tklTgat  tkS7gat  tkC, 

9at_tk7.  «at~tkt.  Saltl,  aBit27aait3, 

Xalt  4 ,  Xad.ts7taitC,  aalt7 ,  aattt ,  aoroDl, 

■oraD2 ,  aava03 ,  a»xaD4 ,  iwtaDS , 
awra0C,aora07,MoraDa,paaa  tk4,paaa_tk5, 
paaa  _tk<.paaa_tk7,paaa_tkT,  ~ 

paaa^tkl,paaa  tk2,paaa_tk3, 
revl7rev4, ra«5, reo<, ro77,  revt, 
rev2,  rav3,  roa^l,  x«ady2,  raady3, 
raady4,raadyS,c«adyC,  taadp7,r*adya,uanaod)  ; 

typo  duaav  typo  la  raa^a  1 . .  255  ; 
typo  t_floTd_typo  la  (D.T.I); 

pooka^  t  flold_oauBt_le  la  aow  oauBa]ratlOB_IO<t_flold_typo) ; 
uao  t_XloTd_oaual_lo;  ~ 

typo  MU>ZUM_nPk  la 
xoeord  ** 

t  :  t  flold_typo; 

Dk  :  '^to^oc  raago  1 . .  8  ; 

8k  :  latoqor  raa^a  1 . . 8 ; 
data  :  obaraetar; 
aad  rooord; 

typo  liqputjMiffor^typo  la 
roeord  ”  ” 

Ok  :  latogor  raB9a  0..8  :>0; 

8k  ;  latogor  raago  0..8  •••O; 
data  :  oharaotor  :> 
oad  roeord; 

typo  output_bu£for_typa  la  array  (l..k)  of  MOinM_TlPS; 


typo  awehlaol_atato_typa  la 
roeord  ~ 

aoxt  :  latogor  :«  2;  — addroaa  of  dooaatroaat  aolghbor 
1  :  latogor  :*  1;  —  atatloaa  own  addroaa 

etr  :  latogor  raago  l..(k4'l)  :■  1;  —  eonator  for  aaaaagaa  aoat 
j  :  latogor  raago  l..k  :«  1;  —  ladox  for  output  buffor 
labuf  :  loput_buffor_typo;  —  atoroa  tbo  roeolvod  aoaaagoa 
outbuf  :  output  buffor_typo  :»  ( (8,2, 1, '2') , (1, 3, 1, '2' ) , 

(8,4,2, ’X’),  (1,5,1, -X-), 

(8,4,1,  ’X'),  (8,7,1,  'X'),  (8,8,1,  'X')  ) 

oad  rooord; 

typo  a«oblao2_atato_typo  la 
roeord  ~ 

aoxt  ;  latogor  :■  3;  —addroaa  of  dooaatroaa  aolghbor 
1  :  latogor  2;  —  atatloaa  own  addroaa 

etr  :  latogor  range  l..(k+l);>  1;  —  oouator  for  Maaagoa  aoat 
j  :  latogor  raago  l..k  :■  1;  —  ladox  for  output  buffor 
labuf  :  Input  buffor  typo;  —  atoroa  tbo  roeolwod  BBaeagoa 
outbuf  :  outputjsuf for_typo  :  -  ( (8, 1, 2,  ’  I  ’ ) ,  (8, 3, 2,  '  1  • ) , 

(8,4,2,  'I').  (*,5,2,  -X*), 

(8,6,2,  -X’).  (*.7,2,  'X'),  (8,8,2,  'X')  ) 

oad  rooord; 

typo  naoblno3_atato_typo  la 
roeord 

aoxt  :  latogor  :■  4;  — addroaa  of  dewnatroaa  neighbor 
1  :  Integer  :<■  3;  --  atatloaa  own  addroaa 

etr  :  latogor  range  l..(k'fl)  :■  1;  —  oouator  for  uaaaagoa  aoat 
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j  :  iiit«g«r  rang*  l..k  :*  1;  —  for  output  buffor 

Inbuf  :  iivwtj»uf£or_t3rpo;  ~  otozoo  tbo  zMolvod  uoooogos 
eutbuf  :  output  buffor  tppo  :>  (0,1,3, 'X'),  (S, 2,9, 'X'), 

0,4,9, -X’), 0.5,9, 'X'), 

(*,«.9,'X’).  0.7,9,  -X’).  O.5.3.  •!•)  ); 

ond  zooezd; 

typo  ■oehii>o4_atoto_typo  lo 
roeezd  ~ 

noxt  :  Intogor  5;  — oddrooo  of  dounotzoou  nolghboz 
1  :  Intogoz  :*  4;  —  ototlono  own  oddrooo 

otz  :  latogoz  zongo  l..(k-<-l)  :*  1;  —  oonntoz  for  uoooogoo  oont 
j  :  iatogoz  zongo  l..k  1;  —  ladox  for  output  buffor 
iabuf  :  input  buffor  typo;  —  otoroo  tbo  rooolvod  aoooogoo 

outbuf  :  output  buffor  typo  {(E,l,4,  *X*),  (*,2,4, 'X'),  (*,3,4, '1'),  (1,5,4, 'X'). 

0.4,4, 'X'),  (*.7,4, 'X'),  0,t,4, 'X')  ); 

ond  rooord; 

typo  iMahinoS_ototo_typo  io 
rooord  ~  ~ 

noxt  :  Intogor  4;  — oddrooo  of  deonotrooa  nolgbbor 
1  :  Intogor  :«  5;  —  ototlono  oon  oddrooo 

otr  :  Intogor  rongo  l..(k-t-l)  1;  ~  eountor  for  Moooogoo  oont 

j  :  Intogor  rongo  l..k  :■  1;  —  indox  for  output  buffor 
inbuf  :  input  buffor  typo;  —  otoroo  tbo  roooivod  owooogoo 

outbuf  :  output  buffor  typo  ((*,  1,5, 'X') ,  (*.2,5, 'X') ,  (*,3,5,  >X’) ,  (1,4,5, ’X') , 

(*.4.5. 'X').  (*.7,5. -X'),  (*,8,5. ‘X')  ); 

ond  rooord; 

typo  OMabino4_ototo_typo  io 
rooord 

noxt  :  intogor  7;  — oddrooo  of  doonotrooa  noighbor 
i  :  intogor  4;  —  ototlono  oon  oddrooo 

otr  ;  intogor  rongo  l..(k-»'l)  1;  —  oountor  for  ooooogoo  oont 

j  ;  intogor  rongo  l..k  :>  1;  --  indox  for  output  buffor 
inbuf  :  input  buffor  typo;  —  otoroo  tbo  roooiood  ooooogoo 

eutbuf  :  output  buffer  typo  :■  ((*,  1, 4, 'X' ) ,  (*,2,  4, 'X' ) .  (*.  3.  *. '1') .  (*.  4, 4, '1') , 

(*.5,4,'X*),  (*,7,4, -X-).  (*,8,4, -X-)  ); 

ond  rooord; 

typo  OMeblno7_ototo_typo  io 
rooord  ~  ~ 

noxt  :  intogor  :«  8;  —oddrooo  of  doonotrooai  nol^ibor 
i  ;  Intogor  7;  --  ototlono  oon  oddrooo 

otr  :  intogor  rongo  l..(k-»-l)  1;  —  oountor  for  uoooogoo  oont 

3  :  intogor  rongo  l..k  :■  1;  —  indox  for  output  buffor 
inbuf  :  input  buffor  typo;  —  otoroo  tbo  roooivod  ooooogoo 

outbuf  :  output  buffor  typo  :■  ((*,1,7, 'X'),  (*,2,7, 'X'),  (*,3,7, 'X'),  (*,4,7, 'X'), 

(*,5,7,  •I').  (*,4,7, -X’),  (*.8,7. 'X')  ); 

ond  rooord; 

typo  ■oebino8_ototo_typo  io 
rooord  ~ 

noxt  :  Intogor  1;  —oddrooo  of  doonotrooo  neighbor 
i  :  Intogor  8;  —  ototlono  own  oddrooo 

otr  :  intogor  rongo  l..(k'fl}  :»  1;  —  oountor  for  ■oooogoo  oont 
j  :  intogor  rongo  l..k  :>  1;  —  index  for  output  buffor 
inbuf  :  input  buffor  typo;  —  otoroo  tbo  roooivod  ooooogoo 

outbuf  :  output  buffor  typo  ( (*,  1, 8, 'X')  ,  (*,2, 8, 'X') ,  (*,  3, 8, 'X') ,  (*,  4,8, 'X') . 

(*.5,8, 'X').  (*,6,8, -X-).  (*.7,8, -X')  ); 

ond  record; 

typo  glebol_vorloblo_typo  io 
record  ~ 

HBOXOM  :  MBDiaM_TTP*  :-(T, 1. 2, ; 
ond  rooord; 


ond  dofinitiono; 


Variable  Definitions^  One  Message  in  Variables) 

with  TSXT_XO;  UM  TBn_XO; 
paokag*  dafinltlona  !• 

nhl  naa  :  oonatant  S; 

k  :~eenatant  :>  7;  —  nuatec  of  rewa  (MaaaQaa)  In  output  kuffor 

typo  aan_traaaltlon_typo  ia  (paaal,paaa2,p*aa3,  paaa4,poaa5,poaaC, 

"  ~  paaa7,p*aat,90tjtkl,90t_tk2, 

gat  tk3,9at_tk479at  tjLS.got  tki, 

9at~tk7 , 9at_tk».  Xaltl.  aalt27»altS, 
aalt4,teit5.2lnlt<,aalt7,anlt«,aera01, 

*oraD2 ,  aMroD3,  Mora04, aotaDS, 
BoraDC,aora07,»oraD>,paaa  tk4,paaa_tk5, 
paaa_tkC, paaa_tk7 , paaa_tkT,  ~ 

paaa~tkl, paaa~tk2 , paaa~tk3 , 
ravl7rav4, revS,  revS, reu7,  root, 
rev2, rev3, raadyl. xaady2,  taady3, 
raady4.raadyS,raady<,raa^7,raadyt,nauaad) ; 

typo  iiiiy  typo  la  conga  1..25S; 

typa  t_fiaTd_typa  la  (D,S,I); 

paoka^  t_flald_aaun_lo  la  na«  anuaacatlon_XO<t_£lold_typa) ; 

uao  t_flaTd_anua_lo;~ 

typo  lBDIOM_nPB  la 
caeord  ~ 

t  :  t  flald_typa; 

0&  :  Tntagar  conga  X . . 8 ; 

SA  :  Intagac  conga  1 . . 8 ; 
data  :  ehacaetac; 
and  caaocd; 

typo  lnput_buf£oc_typa  la 
caoecd  ~  ~ 

DA  :  Intagac  conga  0..8  :«0; 

8A  :  Intagac  conga  0..8  :>0; 
data  :  ehacaotac  :■ 
and  caeocd; 

typo  output_btt££ac__typa  la  accay  (l..k)  of  MBOXQH^TtPB; 


typo  aaehlnal_atata_typo  la 
caeocd 

naxt  :  Intagac  2;  — addcoaa  of  doanatcaaai  nalgbboc 
1  ;  Intagac  1;  —  atatlena  om  addcoaa 

etc  :  Intagac  canga  l..(k-*'l)  :>  X;  —  eountac  foe  awaaagaa  aant 
j  :  Intagac  canga  X..k  X;  —  Indax  foe  output  buffac 
Inbuf  :  lnput_buffac_typo;  —  atocaa  tbo  caoolvad  aoaaagaa 
eutbuf  :  output  buffoc_typa  :■  ((0,2,X, 'X')> (B#3rX, 'X')f 

<1,4,1, 'X').  (*,5,X, 'X'), 

(E,«,X,  'X').  (*.7,X,  -X'),  <1,8,X,  -X-)  ) 

and  caeocd; 

typo  aaehlna2_atata_typa  la 
caeocd  ~  ~ 

next  :  Intagac  3;  — addcoaa  of  downatcaaa  nalghboc 
1  :  Intagac  :■>  .2;  —  atatlena  own  addcoaa 

etc  :  Intagac  canga  X..(k-fX):-  X;  —  eountac  foe  aaaaagaa  aant 
j  ;  Intagac  canga  X..k  :■  X;  —  Indax  foe  output  buffac 
Inbuf  :  lnput_buffoc_typa;  —  atocaa  tba  caoolvad  aMaaagaa 
outbuf  :  output  buffac  typo  :■  ((D,X,2, 'X'), (B,3,2, 'X'), 

(B,4,2, -X’),  (1,5,2, ’X’), 

(1,4,2,  ’X'),  (1,7,2,  ’X').  (1.«.2,  'X')  ) 

and  caeocd; 

typo  aaohlna3_atata_typa  la 
caeocd  ~ 

naxt  :  Intagac  :■  4;  — addcoaa  of  doanatcoaa  nalghboc 
1  :  Intagac  3;  —  atatlona  oan  addcoaa 

etc  :  Intagac  canga  l..(k*l)  «  X;  —  eountac  foe  aaaaagaa  aant 
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j  :  lnt«9»r  ru«*  I..I1  1;  —  iaOm*  tor  ootpiit  bafCMr 

Inbuf  ;  bu£f«r_typ«;  —  rtormo  tba  nealvad  mmooogom 

«utbu£  :  outpot  buf£«r  typ*  :*  ((D,l,3, 'X*), (B,2,S, 'Z')< 

(«.4.3.  'I'). 

{«.«.3.  •I*).  («,7,3,  •!•),  («.3.3.  •!•)  ); 

•nd  Meord; 

tpp*  Mcd>lM4_«tat*_tpp«  la 
raeerd 

BMt  :  iatagar  :«  S;  — addrass  of  doanatraaa  naighbor 
1  :  latagar  :■  4;  —  atatlena  oan  addxaaa 

etr  :  Intagar  raaga  1;  —  eountar  for  rmmmagom  aaot 

J  :  Intagar  ranga  l..k  1;  --  indax  for  ootpot  hnffar 
inbuf  :  input  buffar  tppa;  —  atoraa  tha  raoaioad  aaaaagaa 

eutbuf  :  output  buffar  typa  ;■  ((0,1,4, 'I*) .  (*.2,4, 'X')  ,  (*,3,4,  *1') ,  (1,5, 4, '!*)  • 

(B,«,4, -X*),  (*,7,4, ’X'),  (1,3,4, -X’)  ); 

and  raoord; 

tppa  aMahlao5_atata_tppa  la 
raoord  ~  ~ 

naxt  :  intagar  :■  C;  — addraaa  of  doanatraan  naighbor 
1  :  Intagar  5;  —  atationa  oan  addraaa 

otr  :  intagar  ranga  l..(k-fl)  :■  1;  —  oountar  for  naaaagaa  aant 
j  :  Intogar  ranga  l..k  1;  —  indax  for  output  buffar 
inbuf  :  input  buffar  typo:  —  atoraa  tha  raealaad  naaaagaa 

outbuf  :  output  buffar  typa  :■  ( (D, 1,5, *1') , (*,2,5, *1’ ) , (*, 3,5, 'I') , (*, 4, 5, ‘1') , 
-  “  (*,4,5,  •!•),  (*,7,5,  •X-),  (*,*,5, -I')  ); 

and  raeord; 


typa  naahiao<_atata_typo  la 
raeord 

noxt  :  intogar  :>  7;  — addraaa  of  doanatraaa  naigbbor 
i  :  Intagar  :«  C;  —  atationa  oan  addraaa 

etr  :  intagar  ranga  l..(k-t'l)  :«  1;  —  eountar  for  noaaagaa  aant 
J  :  Intagar  ranga  l..k  1;  —  indax  for  output  buffar 
inbuf  ;  input  buffar  typa;  --  atoraa  tha  raeaivad  naaaagaa 
eutbuf  :  output  buffar  typa  :■  ((0, 1,  5, 'X' ) ,  (*,2, 4, 'I' ) ,  (*,3,  6, 'X' ) , 
“  ~  (*,5.4, -X'),  (*,7,4, 'I'),  (*,*,4, -X*) 

and  raeord; 


(*,4,4.  ’X'). 
); 


typo  aaehina7_atata_typo  ia 
raeord 

noxt  :  intagar  8;  —addraaa  of  dovnatraan  naigbbor 
i  :  intagar  :■  7;  —  atationa  oan  addraaa 

otr  :  intagar  ranga  l..(k41)  1;  —  eountar  for  noaaagaa  aant 

j  :  intagar  ranga  l..k  :■  1;  —  indax  for  output  buffar 
inbuf  :  input  buffar  typa;  --  atoraa  tha  raeaivad  aaaaagaa 

eutbuf  :  output  buffar  typa  ((D,l,  7, 'X') ,  (*,2, 7, 'X') ,  (*,  3,7, 'X') ,  (*,  4, 7, 'X') , 

(*,5,7, 'X'),  (*,4,7, ’X'),  (*,8,7,  -X*)  ); 

and  raoord; 


typa  awehina8_atata_typa  ia 
raoord 

next  :  intogar  :>  1;  —addraaa  of  doanatraaa  naighbor 
i  :  Intagar  8;  —  atationa  oan  addraaa 

etr  :  Intagar  ranga  l.Mk-t-l)  1;  —  oountar  for  naaaagaa  aant 
J  :  intagar  ranga  l..k  1;  —  indax  for  output  buffar 
inbuf  :  input  buffar  typa;  —  atoraa  tha  raeaivad  aaaaagaa 

outbuf  :  output  buffar  typa  :»  ( (D,  1, 8, 'X' ) ,  (*,  2, 8, 'X' ) ,  (*,  3, 8, 'X' ) ,  (*,  4, 8, 

(*,5,8, ’X').  (*,4,8, ’X'),  (*,7,8,  'X')  ); 

and  raeord; 


•1’), 


typo  global_variablo_typo  ia 
raoord  ” 

MlDZgH  :  l■BX0M_TrP*  :-(T,l,2,  •*•)  ; 
and  raoord; 

and  daflnltiona; 
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Variable  Definitions 

There  are  seven  messages  in  outbirf  variable  of  each  machine  and  each  machine  sends 
one  message  to  the  other  machines  in  the  netwmic. 


with  tSXT_XO;  UM  TUR_ZO; 
paekaga  dafinltiena  la 

nuB_of_aaOblnaa  :  oonatant  •; 

k  :  eeastant  7;  —  nmbar  of  ro«a  (aMaaa^aa)  la  output  buffar 
typa  saa_traaaltloa_typa  la  (paaal,paaa2,paaa3,  paaa4,paBaS,paas<, 

~  paaa7,paaaS,9at_tkl,9at_tk2, 

9at  tk3,9at_tk479at_tk579*t  tkC, 

9at~tk7. 9at_tkS,  Saltl,  taltaTSalta, 

XBlt4,  XidtS,  aaltC,Xalt7,  XaltS, 

aMra02 , uoroOa ,  aMraD4 , ueraDS , 

awraOC,aoca07,«OBuD4,pasa  tk4,paaa_tk5, 

paas_tkC,paaa_tk7,paaa_tk¥,  ~ 

paaa_tkl,paaa  tk2,pasa~tk3, 

revl, rev4, ra«¥, rooC, rev7, root, 

rav2, rav3. raadyX, xaady2, roady3, 

roady4, roadyS, taadyC, Eaady7, E«ady4,unusad) ; 

typa  duaaiy  typo  la  ran9a  1..255; 
typa  t_flaTd_typa  la  (D,T,I); 

pack ago  t_flold_anuB_lo  la  naw  anuaMratlon_IO(t_yiald_typa) ; 
uaa  t_flaTd_anin_io;~ 

typa  lW>ZDM_TyPB  la 
raeord 

t  :  t_£lald_typa; 

Ok  :  Tntagar  ranga  1..8; 

8A  ;  Intagar  ranga  1 . . 8 ; 

data  :  eharaotar; 
and  raeord; 

tjrp*  lnput_bu£far_t3fpa  la 
raeord  ~  ” 

Dk  :  Intagar  ranga  0..8  :a0; 

Sk  :  Intagar  ranga  0..8  :a0; 
data  :  eharaotar 
and  raeord; 

typa  output_buf£ar_typa  la  array  (l..k)  of  IIBDIOM_TTPB; 


typo  aaehlnol_atato_typa  la 
raeord  ~ 

naxt  :  Intagar  2;  — addraaa  of  dounatraaa  nalgfabor 
1  :  Intagar  1;  —  atatlona  own  addraaa 

etr  :  Intagar  ranga  l.-tk+l)  :■  1;  —  oountar  for  ■oaaagaa  aant 
j  :  Intagar  ranga  l..k  :•>  X;  —  Indox  for  output  buffar 
Inbuf  :  Input  buffar  typo;  —  atoroa  tba  raealaad  HMaaagaa 
outbuf  :  output  buffar_typa  :>  ( (D. 2, X. 'X’ ) , (D, 3, X, ' Z' ) , 

(D,4,X. 'X'),  (D,5,X, 'X'), 

(D,6,X,  ’X*),  (D,7,X.  'X'),  (D,8,X,  'X')  ); 

and  raeord ; 

typa  aweblno2_atato_typa  la 
raeord  ~ 

noxt  :  Intagar  3;  — addraaa  of  doanatraaa  nolghbor 
1  :  Intagar  2;  —  atatlona  oan  addraaa 

etr  :  Intagar  ranga  l..(k'fl):a  X;  —  oountar  for  aoaaagaa  aant 
]  :  Intagar  ranga  X..k  :■  X;  —  Indax  for  output  buffar 
Inbuf  :  lnput_buffar_typa;  —  atoraa  tba  raoalaad  awaaagaa 
outbuf  ;  output  buffar  typo  :■  ( (D, X.2, 'X' ) , (D, 3,2, 'X' ) , 

<0,4,2, ’X'),  (D,5,2, 'X'), 

<0,6,2,  'X’).  <0,7,2,  'X').  <0,8,2,  'X')  ); 

and  raeord; 


typ*  — ohlt»3_«tat»_typ»  !• 
raeerd 

nwit  :  int«9*v  :>  4;  — addraM  ef  devaatsMa  Mighbor 
1  :  iatagar  :•  3;  —  •tattena  ean  addtvaa 

etr  :  Intagar  ranga  X..(k'»'l)  :>  1;  --  eouatar  for  aaaaagaa  aaat 
j  :  latagar  raaga  l..lc  1;  —  Indax  for  matput  koffar 
labuf  :  livttt  littffar_typa;  ->  atoraa  tba  raoataad  aaaaagaa 
autbuf  :  output  tauffar  typa  :•  (<D,1,3,  *X‘),  (0,2,3. 'X'), 

(0,4,3, •X').(D.S.S.*1'), 

(0.<.3,  'X'),  (0,7.3,  'X'),  (0,a,3,  -I’)  ); 

and  Eaoord; 

typa  aaehlna4^atav  «_typa  la 
raeord 

aaxt  :  Intagar  ;>  5;  — addraaa  of  deanatraaa  nalghbor 
1  :  latagar  :«  4;  —  atatlona  oaa  addraaa 

otr  :  latagar  raaga  l..(k4'l)  :>  1;  —  oonatar  for  aaaaagaa  aaat 
j  :  latagar  raaga  l..k  :>  I;  --  Indax  for  output  buffar 
labuf  :  li^t  buffar  typa;  ->  atoraa  tba  raoalaad  aaaaagaa 

outbuf  :  output  buffar  typa  :•  ( (0, 1, 4, 'X*)  ,  (0,2,4, 'X') ,  (0,3, 4, 'X') .  (D,5, 4, 'X') , 

(0,4,4, 'X').  (0,7,4, ‘I'),  (0,t,4, 'I')  ); 

and  raoord; 

typo  aaeblaoS_atata_typa  la 
raoord 

aaxt  :  latagar  4;  — addraaa  of  downatraaa  nal^ilAor 
1  :  latagar  :■  5;  —  atatlona  own  addraaa 

etr  :  latagar  ranga  l..(k'«-l)  :>  1;  —  oouatar  for  aaaaagaa  aaat 
j  :  latagar  ranga  l..k  :*  1;  —  Indax  for  output  buffar 
labuf  ;  input  buffar_typa;  —  atoraa  tba  raoaivad  aaaaagaa 

outbuf  :  output  buffar  typa  ;«  ( (0, 1, 5,  •!•)  ,  (0, 2, 5. 'X • ) ,  (0,3, 5. 'I' ) ,  (0, 4. 5, 'X ■) . 

(0,4,5, 'I*),  (0,7,5,  •!•),  (0,4,5,  •!•)  ); 

and  raoord; 

typa  aMohlna4_atata_typo  la 
raeord 

next  :  Intagar  7;  — addraaa  of  doanatraaa  neighbor 
1  :  Intagar  4;  —  atatlona  own  addraaa 

otr  :  intagar  ranga  l..(k-M)  ;•  1;  —  eountar  for  aaaaagaa  aant 
j  :  Intagar  ranga  l..k  1;  —  Index  for  output  buffar 
Inbuf  ;  Input  buffar  type;  —  atoraa  tba  raoalwod  aaaaagaa 

outbuf  ;  output  buffar  typa  :«  ((0, 1,4, 'X') ,  (0, 2,  4, 'I') ,  (0,3,  4, 'I' > ,  (0, 4,  4, 'I') . 

(0,5,4, 'I'),  (0,7,4,  •I’),  (0,4,4, 'I')  ); 

and  raeord; 

typa  aadhlna7_atato_typa  la 
raeord 

next  :  Intagar  8;  —addraaa  of  downatraaa  neighbor 
1  :  Intagar  :«  7;  —  atatlona  own  addraaa 

etr  :  intagar  raaga  l..(k+l)  :■  1;  —  eountar  for  aaaaagaa  oant 
j  :  Intagar  ranga  l..k  :■  1;  —  Index  for  output  buffer 
Inbuf  :  Input  buffar  type;  —  atoraa  tba  raoalwad  aaaaagaa 

outbuf  ;  output  buffer  typa  :■  ( (0, 1,7, 'X' ) , (0, 2, 7, 'I' ) , (0, 3, 7, 'I ' ) ,  (0,  4, 7, 'X ' ) , 

(0,5,7,  •!•),  (0,4,7, 'I'),  (0,4,7. ’X')  ); 

and  raoord; 

typa  BMohlna8_atata_typo  la 
raeord 

next  :  Integer  1;  — addraaa  of  downatraaa  neighbor 
1  :  Intagar  8;  —  atatlona  own  addraaa 

etr  :  Intagar  ranga  l..(k+l)  1;  —  eountar  for  aaaaagaa  aant 

j  :  Intagar  ranga  l..k  1;  —  Index  for  output  buffar 
Inbuf  :  Input  buffar  typa;  —  atoraa  tba  raealved  aaaaagaa 

outbuf  :  output  buffar  typa  ( (0, 1,8, 'I') ,  (0,2, 8, 'I') ,  (0, 3, 8, '!•) ,  (0,  4, 8, 'I') , 

(0,5,8, -I-),  (0,4,8, 'I’),  (0,7,8, -I’)  ); 

and  raeord; 

typa  global_variabla_typa  la 
raoord  ” 

HUXOM  :  I«0H)M_TXP1  :-(T,  1, 2,  •W )  ; 
and  raoord; 

and  daflnltiona; 
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Predicate>Action  Table 


Mp*rat«  (Min) 

proesdur*  JkMlys«_Pr*dleata«_IUebla«l(leo«l  :  — nhl  tpp*; 

~  ~  glebAl  :  9l»bal_varl«bXa_tpp«; 

a  :  natural;  ~ 

«  :  In  out  trnnaltton_ataot_paokaga . ataot)  la 


bagln 

eaa*  a  ia 

uhnn  0 

It  {  (global. MDZUN.t  -  O)  and  (global. MOIOM.Ok  -  local. i)  )  thm 
puah(w,  revl)  ; 

•nd  If; 

if  (  (global. MOIOM.t  -  T)  and  (global. MtOZTM.DA  -  local.!)  )  tbna 
pttah(«,gat  tkl) ; 
and  if;  “ 

Oban  1 

puab («, zoadyl) ; 

Oban  2  >> 

if  (local. outbuf (local. j) .t  /»  B)  than 
paata(«,  Xnitl)  ; 
and  if; 

if  (  local. outbuf (local. j) .t  »  B  )  than 
puab («, paaal) ; 
and  if; 
uban  3  «> 

if  (  (global. moimi.t  -  B)  and  (looal.outbuf  (local. ))  .t  /-  B)  and 
(local. ctr  <»  k)  )  than 
puab («, aoraDl) ; 
and  if; 

if  (  (global. MOXOM.t  •  B  )  and  (  (local.outbuf  (local,  j)  .t  ■  B) 
or  (local. ctr  m  (k'fl)  )  )  )  tban 
puab («,  paaa_tkl) ; 
and  if;  ~ 

aban  otbara  ■> 
null; 
and  caaa; 

and  kaalyaa_BradleataaJMaebinal; 


aaparata  (a«ln) 

prooadura  knalysa_Pradloataa_liacbina2  (local  :  ■acblna2_atato_typa; 

~  global  :  global_variabla_typa; 

a  :  natural;  ~ 

«  :  in  out  tranaitlen_ataak_paekago . atack)  ia 


bogin 

caaa  a  ia 

aban  0 

if  (  (global. moXQM.t  -  0)  and  (global. WOXim.Ok  -  local.!)  )  tban 
puab (a, rcv2) ; 
and  if; 

if  (  (global. WDXnM.t  -  T)  and  (global. MBOXUM. DA  -  local.!)  )  tban 
puab  (a,  gat_tk2) ; 
and  if; 

aban  1  •> 

puab (a, raady2) ; 
aban  2  «> 

if  (local.outbuf (local. j) .t  /•  B)  tban 
puab  (a,  Xad.t2) ; 
and  if; 

if  (  local.outbuf (local. j) .t  ■  B  )  tban 
puab (a, paaa2) ; 
and  if; 
aban  3  >> 

if  (  (global. MDXDM.t  >  B)  and  (local.outbuf  (local .])  .t  B)  and 
(local. ctr  <■  k)  )tban 
puab (a,  a»roD2) ; 
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wid  if; 

if  (  (global .IBDXai.t  -  B  )  and  (  (leoal.ootbof  (local,  j)  .t  «  B) 
or  (local. etr  *  (k'fl)  )  )  )  thm 
poah(«,  paaa_tk2); 
end  if; 

ebon  othcra  ■■> 
null; 

end  caac; 

end  Bnalyao_Prcdleatoa_llachlna2; 


aeparato (naln) 

proecdoxc  Bnalyac_Picdleatca_Maablna3 (local  :  ■aahiac3_atatc_typc; 

~  global  :  global_carlabTc_tgpc; 

a  :  natural;  ~ 

w  :  in  out  tranaltion^ataekjaolcaga  ■  atack)  la 


begin 

eaae  a  ia 

eben  0  ■> 

if  (  (global. MnXDM.t  -  0)  and  (global .tBDZOM.DB  -  local.!)  )  than 
puah (w, rov3) ; 
end  if; 

if  (  (global. MBOZOM.t  -  7)  and  (global. WDXOM. DA  -  local.!)  )  then 
puah («, get_tk3) ; 
end  if;  ^ 

eben  1  ■> 

puah  («,  teady3)  ; 

■ben  2  ■> 

if  ( local. outbuf (local. j) .1  /-  B)  then 
puab(«,Xlnit3)  ; 
end  if; 

if  (  local. outbuf (local.)) .t  ■  B  )  then 
puah(w,paaa3) ; 
end  if; 

■bon  3  ■> 

if  (  (global. NUIOM.t  ■  B)  and  (loeal.outbuf  (local. ))  .t  />  B)  and 
(local. etr  <■  k)  )thon 
puah(w,aMreD3)  ; 
end  if; 

if  (  (global .MBOXOM.t  ■  B  )  and  (  (loeal.outbuf  (local.))  .t  •>  B) 
or  (local. etr  «  (k-fl)  )  )  )  then 
puab(e,  paaa_tk3) ; 
end  if;  ~ 

■ben  othera  •> 
null; 
end  eaae; 

end  knalyie_Predioatea_Maohine3 ; 


aeparato (nain) 

procedure  Analyse_Predioatea_Maehine4 (local  :  ■aahine4_atate  typo; 

~  global  :  global_variaElo_type; 

a  :  natural;  ~ 

«  :  in  out  tranaitien_ataok_paekago. atack)  ia 


begin 

eaae  a  ia 

■ban  0  •> 

if  (  (global. MDZQM.t  -  D)  and  (global. MtDXOM.Dk  -  local.!)  )  then 
puah(e, rov4) ; 
end  if; 

if  (  (global. HBDZOM.t  -  T)  and  (global. MtDZQM.Dk  -  local.!)  )  than 
puab(e, get_tk4) ; 
end  if;  ~ 

■ben  1  ■> 

puah (■, ready4) ; 

■ban  2  ■> 

if  (loeal.outbuf (local.)) .t  /■  B)  then 


no 


puab(w,aBit4)  ; 

•nd  if; 

If  (  looal.outbuf (Xeeal. j) .t  ■  B  )  than 
pu«h<w,paaa4) ; 
and  if; 
aban  3 

If  (  <global.MU>zm.t  ■  B)  and  (leeal.antbaf  (local,  j)  .t  /*  B)  and 
(leoal.etr  <<■  k)  )thaa 
paab(w,a»ra04) ; 
and  If; 

If  (  (global. MUXtm.t  -  B  )  and  (  (loeal.outbaf  (looal.  j)  .t  >  B) 
or  (local. etr  *  (k41)  )  )  )  tban 
paab(«,  paaa  tk4); 
and  if; 

idMn  otbara  «> 
null; 

and  caaa; 

and  *aalysaJPradicataaJMadhina4; 


aaparata  (awin) 

procadura  knalysa_PradicataaJMaohinaS  (local  :  aiachina5_atata  type; 

~  global  :  glObal_vaxiaEla_typa; 

a  :  natural; 

w  :  in  out  tranaition_ataok_j>ackaga .  atack)  ia 


begin 

caaa  a  ia 

aban  0  >> 

if  (  (global .MBDIOM.t  <■  D)  and  (global .IKOinM.Dk  m  local.!)  )  tban 
puab(«, revS) ; 
and  it; 

if  (  (global. ISOXOM.t  «  T)  and  (global. IKOZOM. DA  -  local.!)  )  tban 
puab(w,gat  tkS) ; 
and  if; 

aban  1  ■> 

puab (a, raadyS) ; 
aban  2  •> 

if  (local. outbof (local. j) .t  B)  tban 

puab(a,Xnlt5)  ; 
and  it; 

if  (  local. outbuf (local. j) .t  >  B  )  tban 
pusb(a,paaaS)  ; 
and  if; 
aban  3  •> 

if  (  (global .MBOZOH.t  ■  B)  and  (local. outbuf (local.)) .t  /•  B)  and 
(local. etr  <«  k)  )tban 
puab (a,  aMraOS ) ; 
and  if; 

if  (  (global .HBDZDN.t  -  B  )  and  (  (local.outbuf (local. ))  .t  >  B) 
or  (looal. ctr  ■  (k-fl)  )  )  )  tban 
puab (a,  paaa_tk5) ; 
and  if;  ~ 

aban  otbara  ■> 
null; 
and  caaa; 

and  knalyaa_Pradloataa_llaobina5; 


aaparata  (aMin) 

procadura  knalyza_Pradicataa_IUcbina<  (local  :  aMcbina6_atata  typo; 

global  ;  global~varlaEla_typa; 
a  :  natural;  ~ 

a  :  in  out  tranaition_ataok_packago . atack)  ia 


Ill 


bagla 

OM«  •  la 

Mbaa  0  >> 

if  <  (global. IBDZIlM.t  -  D)  and  (global. mxm.Db  -  local.!)  )  than 
pnab(w,retrC); 
and  if; 

if  (  (global .MtOXOH.t  -  «)  and  (global. mxiM.nb  -  local.!)  )  than 
puah  («,  gat_tk6)  ; 
and  if;  ~ 

idtan  1  >> 

poah  (w,  caadyS)  ; 
aban  2  >> 

if  ( local. otttbuf (local. j) .t  />  B)  than 
paab(w,Bnit€) ; 
and  if; 

if  (  local. outlMif  (local,  j)  .t  «  B  )  tban 
puab(«,paaaC)  ; 
and  it; 
wiMn  3 

if  (  (global. mZQM.t  >  B)  and  (local.ontbuf  (local.))  .t  /-  B)  and 
(local. otr  <a  ]c)  )tbm 
puab(«,aocaDC) ; 
and  if; 

if  (  (global. NU>ZOM.t  ■  B  )  and  (  ( local. outbuf (local.]) .t  >  B) 
or  (local. otr  •  (Ic-t'l)  )  )  )  tban 
puab  («,  paaa_tk6)  ; 
and  if; 

«ban  otbara  ■> 
null; 

and  eaaa; 

and  bnalyBa_PradiaataaJMaabina<; 


aaparata (main) 

prooadura  Aaalysa_Prad!cataa_Haeb!na7 (local  :  nadblna7_atato  typo; 

~  ~  global  :  global~var!aSla_typa; 

a  :  natural;  ~  ^ 

V  :  !a  out  traaa!t!eo_ataek,_packaga.ataok) 


bogln 

caaa  a  !a 

afaon  0  «> 

if  (  (global .MBDXOM.t  -  0)  and  (global .MU>I0M. DA  •  local.!)  )  tban 
puab(w,  rcv7)  ; 
and  if; 

if  (  (global. MBOZDM.t  -  T)  and  (global .MBDZDM. DA  -  local.!)  )  tban 
pusb(w,gat_tk7) ; 
and  !f;  ^ 

wban  1  a> 

puab  («r,  raady7)  ; 
whan  2  ■> 

!f  (local. outbuf (local. j) .t  B)  tban 
puab  (w,  Xnit7)  ; 
and  !f; 

!f  (  local. outbuf (local.]) .t  •  B  )  than 
puab(«,paaa7)  ; 
and  !f; 
aban  3  «> 

!f  (  (global. WDZDM.t  -  B)  and  (local. outbuf  (local.  ])  .t  /-  B)  and 
(local. otr  <■  k)  )tban 
puab  (w,  awra07)  ; 
and  !f; 

!f  (  (global. WDZQM.t  ■  B  )  and  (  (local,  outbuf  (local.])  .t  -  B) 
or  (local. otr  ■  (k-fl)  )  )  )  tban 
puab(w,  paaa_tk7) ; 
and  !f; 

aban  otbara  ■> 


!a 
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null; 


•nd  oam; 

•nd  AMlym*_Pr«dle*t«a_IUehlM7; 


MpAcat*  (aaln) 

proeadux*  AMlysa_Pr«dtoat«a_IUeblM>(leeal  :  awch  1  r>at_at«ta  typa; 

~  ~  global  :  global~TarlaEla_tppa; 

a  :  natural;  ~  ~ 

«  :  la  out  traaaition_ataok_paokaga.ataek)  la 


bagln 

eaaa  a  la 

«ban  0 

If  (  (global. IBDIim.t  -  0)  and  (global. ISOZm.DJl  -  looal.l)  )  than 
puab(a, rovS) ; 
and  if; 

If  (  (global. MtOZTIM.t  -  T)  and  (global. IBOXm.Db  *  local.!)  )  than 
puab (a, gat_tka ) ; 
and  if; 

aban  1  -> 

puab (a, xaadyS) ; 
aban  2  >> 

if  (local. otttbuf (local. j) .t  /•  B)  tbon 
puab  (a,  Bait*)  ; 
and  if; 

if  (  local. outbuf (local. j) .t  •  B  )  than 
puah(a,paaaa)  ; 
and  if; 
aban  3  *> 

if  (  (global.  MOZOM.t  -  B)  and  (local,  outbuf  (local.))  .t  /-  B)  and 
(local. ctr  <■  k)  )tban 
pnab(a,aMraoa)  ; 
and  if; 

if  (  (global .MBDIOM.t  -  B  )  and  (  (local. outbuf (local.))  .t  -  B) 
or  (local. ctr  >  (k-fl)  )  )  )  than 
puab  (a,  paaa_^tka) ; 
and  if;  ^ 

aban  otbara  ■> 
null; 
and  caaa; 

and  Bnalyaa_Pradicataa_IUcbinaa; 


aaparata  (awin) 

procadura  Action  (  in_ayataa_atata  :  in  out  6atata_raoord_typo; 

in~tranaltion  :  in  out  acn_tranaition  .typ*.- 
out_ayataai_atata  :  in  out  6atato_rocerd_typa)  ia 


bagln 

caaa  in_tranaition  la 
aban  rcvl  «> 

eut_ayataai_atata  .a)aobinal_atata .  inbuf .  SA 

~  T*in_ayataai_atata .  global_variablaa .  MBDZQM .  SA; 

out_ayataai_at  ata .  •aobinal_atata .  ii^f .  data 

~  :Bin_ayataai_atata  .global_aariablaa  .MDZBII.data; 

aban  rov2  >>  ~ 

out_^ayataai_atata .  awcbina2_atata .  inbuf .  SA 

"  TBin_ayataai_atata .  global_variablaa  .mZOIf .  SA; 

eut_ayataai_atata .  aukchTna2_atata .  inbuf .  data 

~  :  ain_ayataai__atata .  global_aar  iablaa .  MDZtlM .  data ; 

aban  rov3  ~  ~  ~ 

out_ayataai_atata .  awohlna3_atata .  inbuf .  SA 

~  :  ■ln_ayataai^atata  .global_variablaa  .MU>Z0M.  SA; 

out_ayataai_atata  .aMohina3_atata .  ii^f  .data 
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.glolMljrar  labia*  .IBDXDM.data; 
«b*n  reir4  ■>  **  ~  ~ 

oiit_syst*ai_atata .  ■awhlna4_atata .  labaf .  U 

**  Tala_ayst*ai_ata¥a.global_TarlabIaa  .MSXVM.Eb; 

ettt_aystaai_aeat* .  ■aobIaa4_stat« .  ioSaf .  data 

~  :  >ia_systaai_atat* .  glabal_variabl*s .  MDXM .  data ; 

Mban  rovS  >>  ~ 

aut  syataai_atata.aaehif>*S  atata. labaf .Sb 

:-la_aysta«  atata.glabal  varlablaa.IBbnil.U; 
aat_ayataa_stata .■aehTaaS^atata.lnEaf .data 

~  T-la^ayataa_atata  .glabaljvarlablaa  .MDXm.data; 

aban  roT<  ~  ” 

aat_ayBtaai_atata  .«aehla*C_atat* .  labaf .  tb 

~  Tala_ayataai  atata. global  vaclablaa.IKDZm.Cb; 

oat_ayat*a_atat* .  aaflhTna<_atata .  li£af  .data 

~  TBla^ayat*a_atata .  glabal_aarlablaa .  MU>XIJM .  data  ; 

abaa  rav7  ■>  ^ 

out_ayat*a_atata .  ataebla*7_at  ata .  labaf .  bb 

~  :«la_ayBt*«  Btata. global  aarlablaa.MDZQN.Sb; 

oat_ayat*a_*tat* .  ■afihTna7^Btata .  laEaf  .data 

T>la_ayataai_atat* .  glabaljaarlablaa .  MOZIM .  data  ; 
obaa  raa#">  ”  ~  ~ 

eat_ayat*«_Btata .  aMehloaa_atata . labaf . Sb 

~  Tala_ayataa_atata. global  aarlabloB.MOXOM.Sb; 

ottt_ayataai_atata .  aaahTnat^Btata .  laEiif .  data 

~  Taln_ayataa>_atata.glob*l_aarlablas  .MDXlJM.data; 


aboa  raadyl  |  raadyf  |  raadyS  | zaady4 | raadyS 
attt_ayataai_atata  .global_aarlablaa  .IBOXinf  .t 


taadyS I raady7 I raadyt  «> 
:>  ■  ; 


abaa  gatjtkl  •i> 

oat_ayataa_atata.global_aarlablaa.WOZDM.t  :■  S  ; 
attt~*y*taa~Btata.aaohln*l_at*ta.etr  1; 
abaa  gBt_tk2'"*>  “ 

oat_*yat*«_*tata.global_a*rlabla*.mxtm.t  :*  S  ; 
oat~*yataaratata.aaabln*2_atata.etr  :>  1; 
abaa  ” 

ottt^ayat*Bi_atata.global_aarlablaa.MU>ZtM.t  :■  I  ; 

abaa  gat_tk4~«>  “ 

aat_ayatoa_atata.global_aarlablaa.m>ZlM.t  :■  I  ; 
oat~ayataa~atata.awolilaa4__atata.etr  :«  1; 
abaa  g*t_tk5”-> 

aat^ayataw_atata.glabal_aarlablaa.MBD20N.t  :>S; 
oat~ayataai_atata.awatalnaS_atata.etr  1; 
abaa  ^t_tkC  ■>  ~ 

aat_ayataai_atata.global_aarlablaa.lSOZUM.t  g  ; 
oat~ayataw~atata.awdilaaC_atata.etr  1; 
abaa  gBt_tk7~«>  ~ 

eat_ayataa_atata.global_«arl*blaa.mzaM.t  B  ; 
oat~ay*taw~atata.awetalaa7_atata.etr  :»  1; 
abaa  g*t_tkC~«>  ~ 

oat_ayataw_atata.global_aarlablaa.NK>20M.t  :m  b  ; 
eat3ayatoa~atata.awetalnaC_atata.etr  ;■  1; 


Obaa  paaal  t  paaajtkl  «> 

eut_*yataw_atata.global_aarlabla*.mzUM.t  :■  T; 
oat3*yataw_atata .  global_varlablaa  .MUXTM.  Db 

~  ~  ln_ayataw_atata.awetalnal_atata.na3it; 

eut_ayataa_atata.gletaal_aarlSblaa.lSOZm.dat*  :«  'B'; 
eut^ayatow^atata  -global^varlablaa  .ICOXm.Sb 

~  ~  in_ayatow_atato  .aianhlnal_atata  ■  1 ; 

dtaa  pa*a2  |  paa*_tk2  ■>  ~ 

oat_ayataw_*tato.glebal_aarlabla*.MBt>XTm.t  :■  T; 
eut3*y*kaa3atata .  global^ver  labia*  .•■OZXM .  Ob 

~  ~  :■  ln_ayataw_atata.naeblna2_atato.naat; 

oat_ayatoa_atata.gletaal_aarl&laa.MU>ZOII.data  :* 
out^ayatow^atata . global^vat lablaa . WDXOM . 8b 

~  ~  :■  ln_ayataa_atata.waatalno2_Btat*.l: 

obaa  paaaS  |  paaa_tk3  ■>  ~  ~ 

oat_ayataw_atata.global_v*rlabla*.ICOXtnf.t  :■  T; 
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out_ayatM_atat*  .global_varlablM  .MOZtM.DJk 

~  ~  in_ayataai_atat*.a«ebina3_atata.Baxt; 

eat_ayata«_atata.global_varlabl*a.lSDnM.data  :>  *1'; 
out~ayataai~atata .  glebal_variabl*a .  mzaM.  SA 

:■  ln_ayata«_atata.a«^iaa3_atata.l; 
abaa  paaa4  |  paaa_tk4  >> 

out_ayataai_atata.glObal_aarlablM.lKOZTM.t  T: 
oat_ayataat_atata .  global^raxlablaa  .MCOZOM.Ob 

in_ayat«a_atata.M^laa4_atata.naxt; 
eut_ayataai_atata.glol>al_vaxlabl*a.lBOZtn(.data  :* 
eat~ayataaratata  .global~aarlablaa  .l■OXtM.a& 

~  la_ayataai_atat*.aMahina4_atata.l; 

whan  paaaS  |  paaa_tlt5  ->  ~ 

oat_ayataai_atata.glebal_aarlablaa.lSDZt>M.t  T; 
ettt_ayata«_atata .  glabal~varlablaa  .IBDXDIi.DA 

~  ln_ayataai_atata.aM^inaS_atata.aaxt; 

oat_ayataai_atata.glatel_varl^laa.lBOZTM.data  :■>  'S'; 
aut_ayataai~atata  .glabal~aaxlablaa  .MOZQM.SS 

la_ayataa_atata.awablnaS_atata.l; 
aban  paaaC  |  paaa_tkC  my 

aut_ayataa_atata.glabal_aariablaa.Mn>ZIIM.t  :>  T; 
out~ayataaratata  .global_aarlablaa  .MOZm.DS 

~  la_ayataai_atata.awablAaS_atata.naxt; 

ottt_ayataa_atata.global_aarlablaa.MOZaM.data  :■  'S'; 
ottt~ayataa_atata .global_varlablaa .MOZOM.Sk 

;a  ln_ayataa_atata.aweblAaC_atata.l; 
Oban  paaa7  |  paaa_tk7  my  ~ 

ottt_ayataa_atata .  gloS»al_varlablaa .  MOZDM .  t  :  >  T  ; 
ottt~ayataB~at ata . global_varlablaa . MOZOM . OS 

~  ~  :m  ln_ayataa_atata.aachlna7_atata.naxt; 

ottt_ayataa_atata.global_aarlablaa. MOZOM. data  :>  'S'; 
ottt_ayataa_atata .global~varlablaa . MOZOM. SA 

~  :■  ln_ayataa_atata.naahlna7_atata.l; 

abaa  paaaS  I  paaa_tkS 

ottt_ayatan_atata.glQbal_varlablaa. MOZOM. t  T; 
ont~ayataa~atata .global~vaxlablaa .MOZOM. DA 

~  ~  :■  ln_ayatan_atata.aaahlnaS_atata.naxt; 

ottt_ayataa_atata.global_varl^laa.MSOZOM.data  :■  'S'; 
oat~ayataa~atata . global^va^iablaa . MSDZOM. SA 

~  ~  :■  ln_ayataa_atata.mcblna8_atata.l; 


aban  Xaltl  «> 

out_ayataa_at ata . global_varlablaa . MOZOM 
:■  ln_ayatan_atata  .aa^lnal_atata .otttbttf  (ln_ayataa_atata  .aachlnal_atata . )) ; 
ottt_ayataa_atata.aaahlnal_atata.Otttbtt£(ln_ayataa_atata.Bacblnal_atata.  j)  .t  :■>  S; 
ottt~ayataa~atata.aaahlnal_atata.ctr  ~ 

(ln_ayatw_atata.aachlnal_atato.ctr  nod  8)  +  1; 
ottt_ayataa_atato .  aa^lnal_atata .  j 

~  ~  (ln_ayataa_atato.nachlnal_atata.  j  awd  7)  -f  1; 

aban  XBlt2  «>  ~ 

ottt_ayataa_atato . global_varlabloa .MOZOM 
:m~  ln_ayataa_atata  .aaeblna2_atata  .otttbuf  (ln_ayataa_atato  .aarhlna2_atata  .j); 
out_ayataa_atata.aaeblno2_atato.otttbttf (ln_ayatoa_atata.aaoblno2_atata.  j)  .t  S; 

oat_ayataa_atata .naahlna2_atata . ctr 

~  ~  (ln_ayataa_atata.aaahlna2_atato.etr  and  8)  *  1; 

ottt_ayataa_atata  .aa^lna2_atata .  j 

~  (ln_ayataa_atato.aachlna2_atata. ]  nod  7)  'f  1; 
aban  Xad.t3  ■•>  ~  ~  ~ 

ottt_ayataa_atata .global_varlablaa .MSOZOM 
:«~ln_ayataa_atata .aaehlno3_atata.ootbaf  (ln_ayataa_atato . aanh lna3_atata .  j)  ; 
ottt_ayataa_atata.aaahlna3_atato.otttbttf  (ln_ayataa_atata.aaohlna3_atata.))  .t  S; 

ottt_ayatan_atata.aaahlna3_atata.atr  ~  ~  ~ 

~  (ln_ayatoa_atato.aachlna3_atata.etr  aod  8)  'f  1; 
ottt_ayatoa_atata  .aa^lna3_atata .  j 

~  ~  :m  (ln_ayataa_atata.aachlna3_atata. 3  nod  7)  'f  1; 

aban  Xait4  ■>  ~ 

oat_ayataa_atato .global_aarlabloa .MOZOM 
:>~ln_ayatan_atata  .aaeblna4_atato  .otttbu£(ln_ayataa_atata  .aaebloo4_atata .  j)  ; 
ont_ayatan_atata.aaeblna4_atata.etttbttf (ln_ayatan_atata.aaohlno4_atata. j) .t  ;■  S; 
ottt~ayatoa_atato.aachlna4~atata.etr  ~  ~ 

:m  (ln_ayatM_atata.aachlna4_atata.ctr  nod  8)  1; 
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Ottt_a7«t«a_«tat«  .MablfM4_atat* .  j 

:■  (ln_ayataM_atata.MahiM4_atata.  j  aod  7)  4'  1; 
iriMn  Balts  «>  ~  ~ 

out_a7ataai_atata .  global_Tar  lablaa .  IBOZTM 

:•  ln_ayataM_atata.aM^laaS_atat«.outbuf  (ln_a7ataai_atata.Baehlna5_atata.  j)  ; 
eut_ay'ataai_atata.aMiohii>a5_atata.otttbuf  (ln_ayata«_atata.aaeblaa5_atata.  j)  .t  :■  B; 
out_ayataai_atata.awehliia5_atata.otr  ~  ~ 

(ln_ayataw_atata.MiehlfM5_atata.etr  wod  B)  4  1; 
eut_ayataai_atata.awehlnaS_atata.  j  ~ 

:■  (ln_ayataa|_atata.Miohlna5_atata.  j  awd  7)  4  1; 
whan  XaltS  ■>  ~  ~  ~ 

eut_ayataB_atata  .global_aarlablaa  .MOIXM 

ln_ayataai_atata.aw^lnaC_atata.oathuf  (ln_ayataw_atata.nwehlfM6_atata.  j)  ; 
out_ayataai_atata.aaohlnaC_atata.outbof  (ln_ayBtaw_atata.aMehlna6_atata.  j)  .t  :>  B; 
out_ayataai_atata.aaehlnaC_atata.etr  ~  ~ 

~  (ln_ayataiB_atata.aaehlaa6_atata.etr  aod  B)  4  1; 

eut_ayataa_atata  .aanhina6_atata .  j  " 

~  ~  (ln_ayataa_atata.aaehlna6_atata. j  aod  7)  4  1; 

aban  Balt7  ■>  “  ~ 

out_ayataa_atata  .globaX_aarlablaa  .MU)  KM 

*"_*y*~^_**‘**~-*  ^  4  — ..V4— jy  . 

out_ayataa_atata.aaehina7_atata.euttaaf  (ln_ayataa_atata.aaohlna7_atata.  j)  .t  :■>  B; 
out_ayataa_atata.aaohina7_atata.etr  ~ 

:•  (ln_ayatM_atata.Baehina7_atata.ctr  aod  B)  4  1; 
out_ayataa_atata . aaehlna7_atata . j  ~ 

(in_ayatan_atata.aachlna7_atata .  j  aad  7)  4  1; 
aban  XaltB  >>  ~  ~ 

out_ayataB_atata .  global_variablaa  .ISO  KM 

ln_ayataa_atata  .aa^lnaB_atata.eutbuf  (in_ayataa_atata  .aaehlnaB_atata  .j); 
out_ayataa_atata . aanh 1 naB_atata . outbuf ( ln_ayataa_atata .aachlnaB_atata . j ) .t  B; 

out_ayataa_atata . aaehlnaB_at ata . etr 

(ln_ayataa_atata.aacblna8_atata.etr  aod  B)  4  1; 
out_ayataB_atato .  aaohlnaB_atata .  j 

~  ~  (ln_ayataiB_atata.aaohlnaB_atata. j  aod  7)  4  1; 

afaan  noraOl  |  aoraD2  |  aoraOS  |aoraD4  laaraOS  |nioraD6|aoraD7  jaaraOB  ■> 
null; 

afaan  otbara  ■> 

put("Brror  In  action  preoadura") ; 

and  eaaa; 

and  Action; 
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Output  Fonnat 


MparAt*  (aaln) 

preoaduM  eutputjBtupla  (tupla  :  in  out  Oatato  taeoxd  tppa)  la 
bagin  ~  ~ 

if  prlnt_haadar  than 
naw_lina(2) ; 
aat  ool(7); 

pttt~lina  ( "al ,  ai2 ,  a3 ,  a4 ,  aS ,  aC ,  ■? ,  *8 ,  laoZtM .  t ,  WSZTM .  DA,  MOXtM .  SA,  IBOZIM .  data” ) 
printjbaadar  :>  falaa; 

alaa  ~ 

put(”  ["C  lntagar'iaaga(ti9la.aaahliia_atata<l))  ); 
put("  ,  "); 

put  (  Intagar '  lawga  (tupla  .Bwdblna_atata  (2)  )  )  ; 
pnt(”  ,  "); 

put  <  Intagar ' laaga (tupla .aaahlna_atata (3) )  )  ; 
put(”  ,  "); 

put(  Intagar '  iaaga  (ti^la  .aaehlna  atata(4))  ); 
put("  , 

put(  Intagar'laaga  (tupla .aaohina  atata(S))  ); 
put(-  . 

put  (  intagar '  iaaga  (tupla  .aaahlna_atata  (6) )  )  ; 
put(“  ,  ~ 

put (  intagar ' iaaga (tupla .aaohina  atata (?) )  ) ; 
put("  , 

put (  intagar ' iaaga (tupla .aaohina_atato (8) )  ) ; 
put(''  ,  ~ 

t__flald_anua_lo. put  (tupla. global_varlablaa.lBDXDH.t,  aat  ■>  uppar_caaa)  ; 
putC*  ,  ~ 

put  (tupla. global  variablaa  .MBOZOM.DA,  width  «>  1)  ; 
put(" 

put  (tupla, global_variablaa.lBOZDM.SA,  width  •>  1); 
put(*  ,  ");  ~ 

put  (tupla  .global  variablaa  .IBDIOM.data)  ; 
put(-  ]"); 
and  if; 

and  output_6tupla; 
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Program  Output  (No  Message  in  oifldicf  Variable) 
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Program  Output  ( One  Message  in  ouUfttf  Variable) 
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SOMORT  or  RB8CH8BZLZTT  JUULTSZ8 
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2 

1  aoradi 

I  Maohiaa  5  Unaxaeutod  Traaaltlona  | 


1  rroai 

To 

1  Unaxaeutod  Tranaltlon 

1  0 

1 

1  rov5 

1  1 

0 

1  raady5 

1  2 

0 

1  paaa5 

1  3 

2 

1  aoradS 

123 
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Program  Output  (  More  Than  One  Message  in  outhu/Variable) 


0 

1 

2 

3 

4 


STSnM  RBftCBJkBZLXTT  6IUFB 


I  0,  0,  0. 
I  2,  0,  0, 
[  3,  0,  0, 
I  3,  1,  0. 
[  3,  0,  0, 


0,  0,  0, 

0,  0,  0, 

0.  0.  0, 

0,  0,  0, 

0.  0,  0. 


0,  0  1  0 
0,  0  ]  0 
0,  0  ]  0 
0.  0  J  0 
0,  0  )  1 


gmtjtkl 

SBltl 

rav2 

r«ady2 

aoz«dl 


1 

2 

3 

4 

1 


SQMORT  or  nJkCBABZLXTT  UULTSXS  (JUIAX.TSXS  COteiSTBO) 


Mtoibar  of  atatas  ganaratad  :S 
Nuabar  of  atataa  analysad  :5 
Muabar  of  daadleeka  :  0 


OMBXSCUTBO  TRMSXTXONS 


1  Maehlna 

1 

Onajcacutad  Tranaitlona 

1  Froa  1 

To 

1  Onaxaeutad  Tranaltlon 

1  0  1 

1 

1  rovl 

1  1  1 

0 

1  raadyl 

1  2  1 

0 

1  paaal 

1  3  1 

0 

1  paBS_tkX 

1  Maehlna 

2  Onaxacutad  Tranaitlona 

1  Froa 

1 

To 

1  Unaxaeotod  Tranaltlon 

t  0 

1 

2 

1  gat  tk2 

1  2 

1 

3 

1  xalM 

I  2 

1 

0 

1  paaa2 

1  3 

1 

2 

1  aMrad2 

1  3 

I 

0 

1  paaa  tk2 

1  Maehlna 

3  Onaxaeotad  Tranaitlona 

1  Froa 

1 

To 

1  Unaxaeutad  Tranaltlon 

1  0 

1 

1 

1  rev3 

1  0 

1 

2 

1  gat  tk3 

1  X 

1 

0 

I  raady3 

1  2 

1 

3 

1  xalt3 

1  2 

1 

0 

1  paaa3 

1  3 

1 

2 

1  aorad3 

1  3 

1 

0 

1  paaa_tk3 
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I  Wchlna  4  DiMMcut*d  YruMltlona 


I  Wxem  I  To  |  OiMMaut^d  Tranaitloo  | 


I  lUehlM  S  On«MCttt«d  Tranalttona 


I  Vroa  I  To  I  OaMcaoutad  Traaattion  | 


1  1 

roaS 

1  2 

oat  tkS 

1  0 

raadyS 

1  3 

xifdltS 

1  0 

paaaS 

1  2 

noradS 

1  0 

paaa_tk5 

I  Maehlna  6  nnaxaeutad  Tranaltlona 


I  Vroai  I  To  |  Onaxaoutad  Tranaltlon  | 


I  Maoblno  7  Unameutad  Tranaltlona 


I  Froai  I  To  |  Onaxaoutad  Tranaltlon  | 


1  1 

roa7 

1  2 

oat  tk7 

1  0 

raa3y7 

1  3 

XBd.t7 

1  0 

paaa7 

1  2 

aM»rad7 

1  0 

paao_tk7 

I  Madhlna  S  Onaxaoutad  Tranaltlona 


I  Froai  I  To  I  Onaxaoutad  Tranaltlon  | 


reirt 

9ot_tk4 

raadyF 

xalti 

paaat 

■oradt 

paaa_tkt 
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Program  Output  (Global  Reachability  Analysis) 


There  are  seven  messages  in  variable  of  each  machine. 


RUCBABXLXTT  AIULT8Z8  of  :tb8. aaa 
8PBCXrZCAXZ0M 


1  Woohlno  1  8t«to 

Tranoltioaa  | 

1  rro« 

To 

1 

Tranaltloa  | 

1  0 

1 

1 

revl  1 

1  0 

2 

1 

gat  tkl  1 

1  1 

0 

1 

zaaSyl  1 

1  2 

3 

1 

nltl  1 

1  2 

0 

1 

paaal  I 

1  3 

2 

1 

anradl  I 

1  3 

0 

1 

paaajtkl  j 

1  Maohlna 

2  Stata 

Tranaitloaa  | 

1  Froa 

To 

1 

Tranaltion  | 

1  0 

1 

1 

Eav2  1 

1  0 

2 

1 

gat  tlc2  I 

1  1 

0 

1 

raa3y2  1 

1  2 

3 

1 

nlt2  1 

1  2 

0 

1 

paaa2  I 

1  a 

2 

1 

a»Ead2  1 

1  3 

0 

1 

paaa_tk2  | 

1  Maohlna 

3  Stata 

Tranaltiona  | 

1  F*o« 

To 

1 

Tranaltion  | 

1  0 

1 

1 

rev3  1 

1  0 

2 

1 

gat  tk3  | 

1  1 

0 

1 

raadya  I 

1  2 

3 

1 

xalt3  1 

1  2 

0 

1 

paaa3  j 

1  3 

2 

1 

awra<U  I 

1  3 

0 

1 

paaa_tk3  j 

1  Maohlna 

4  Stata 

Tranaltiona  | 

1  Froa 

1 

To 

1 

Tranaltion  I 

1  0 

1 

1 

1 

rov4  1 

1  0 

1 

2 

1 

oat  tk4  1 

1  1 

1 

0 

1 

raa3y4  I 

1  2 

1 

3 

1 

xalt4  1 

1  2 

1 

0 

1 

paaa4  I 

1  3 

1 

2 

1 

aMrad4  1 

1  3 

1 

0 

1 

paaa_tk4  j 

1  Maohlna 

S  stata 

Tranaltiona  | 

1  Froa 

1 

To 

1 

Tranaltion  I 

1  0 

1 

1 

1 

revS  1 

1  0 

1 

2 

1 

gat  tkS  j 

1  1 

1 

0 

1 

raaSyS  j 

1  2 

1 

3 

1 

nits  1 

1  2 

1 

0 

1 

paaaS  I 

1  3 

1 

2 

1 

aoradS 

1  3 

1 

0 

1 

paaa_tk5  j 
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1  Mschlns  C  Ststs 

Trsasttlens 

1 

1  rrea 

fo 

1 

Transition 

1 

1  0 

1 

1 

rerC 

1 

1  0 

2 

1 

oat  tk< 

1 

1  1 

0 

1 

raaSyC 

1 

1  2 

3 

1 

mite 

1 

1  2 

0 

1 

pasaC 

1 

1  3 

2 

1 

aoradC 

1 

1  3 

0 

1 

pass_tk< 

1 

1  Msahlna  7  Ststs 

Transitions 

1 

1  2roa 

To 

1 

Transition 

1 

1  0 

1 

1 

re»7 

1 

1  0 

2 

1 

9at  tk7 

1 

1  1 

0 

1 

rsa^7 

1 

1  2 

3 

1 

aait7 

1 

1  2 

0 

1 

pass7 

1 

1  3 

2 

1 

norad7 

1 

1  3 

0 

1 

paaa_tk7 

1 

I  ItoehltM  •  St«t«  Transit  ion*  I 


1  Proa 

1 

To 

1 

Transition  I 

1  0 

1 

1 

1 

rovS  1 

1  0 

1 

2 

1 

got  tka  I 

1  1 

1 

0 

1 

MaZyi  1 

1  2 

1 

3 

1 

asitt  1 

1  2 

1 

0 

1 

passt  1 

1  3 

1 

2 

I 

aorsda  j 

1  3 

1 

0 

1 

paas_tkt  1 

MUCBABXIITT  GMPB 

(aa ,  *2 ,  *3 .  n4 ,  nS ,  aS,  aT ,  aS ,  ICOXUM .  t ,  MRonm .  DA,  MBOXXm .  IBOXIM .  dsts  ] 


0 

(  0 

0 

0 

0 

0 

0 

0 

0 

T 

1 

2 

B 

1 

pat  tkl 

1 

1 

I  2 

0 

0 

0 

0 

0 

0 

0 

B 

1 

2 

B 

] 

aaitl 

2 

2 

{  3 

0 

0 

0 

0 

0 

0 

0 

0 

2 

1 

3 

] 

rea2 

3 

3 

(  3 

1 

0 

0 

0 

0 

0 

0 

D 

2 

1 

Z 

] 

raady2 

4 

4 

{  3 

0 

0 

0 

0 

0 

0 

0 

B 

2 

1 

Z 

] 

aoradl 

5 

S 

(  2 

0 

0 

0 

0 

0 

0 

0 

B 

2 

1 

Z 

] 

nitl 

4 

6 

[  3 

0 

0 

0 

0 

0 

0 

0 

D 

3 

1 

Z 

] 

rea3 

7 

7 

(  3 

0 

1 

0 

0 

0 

0 

0 

D 

3 

1 

Z 

1 

raady3 

a 

a 

(  3 

0 

0 

0 

0 

0 

0 

0 

B 

3 

1 

Z 

1 

aoradl 

9 

9 

[  2 

0 

0 

0 

0 

0 

0 

0 

B 

3 

1 

Z 

1 

aaitl 

10 

10 

I  3 

0 

0 

0 

0 

0 

0 

0 

D 

4 

1 

Z 

1 

raa4 

11 

11 

(  3 

0 

0 

1 

0 

0 

0 

0 

D 

4 

1 

Z 

] 

raady4 

12 

12 

(  3 

0 

0 

0 

0 

0 

0 

0 

B 

4 

1 

Z 

] 

aoradl 

13 

13 

[  2 

0 

0 

0 

0 

0 

0 

0 

B 

4 

1 

Z 

] 

aaitl 

14 

14 

(  3 

0 

0 

0 

0 

0 

0 

0 

D 

5 

1 

Z 

1 

reaS 

15 

15 

I  3 

0 

0 

0 

1 

0 

0 

0 

D 

5 

1 

Z 

1 

raadyS 

14 

1« 

[  3 

0 

0 

0 

0 

0 

0 

0 

B 

5 

1 

Z 

1 

aoradl 

17 

17 

(  2 

0 

0 

0 

0 

0 

0 

0 

B 

5 

1 

Z 

] 

aaitl 

18 

la 

[  3 

0 

0 

0 

0 

0 

0 

0 

D 

4 

1 

Z 

] 

rea4 

19 

19 

(  3 

0 

0 

0 

0 

1 

0 

0 

D 

4 

1 

Z 

1 

raady4 

20 

20 

(  3 

0 

0 

0 

0 

0 

0 

0 

B 

4 

1 

z 

] 

aoradl 

21 

21 

[  2 

0 

0 

0 

0 

0 

0 

0 

B 

4 

1 

z 

1 

aaitl 

22 

22 

{  3 

0 

0 

0 

0 

0 

0 

0 

D 

7 

1 

z 

] 

roa7 

23 

23 

[  3 

0 

0 

0 

0 

0 

1 

0 

D 

7 

1 

z 

1 

raady7 

24 

24 

I  3 

0 

0 

0 

0 

0 

0 

0 

B 

7 

1 

z 

1 

aoradl 

25 

25 

(  2 

0 

0 

0 

0 

0 

0 

0 

B 

7 

1 

z 

1 

aaitl 

24 

24 

[  3 

0 

0 

0 

0 

0 

0 

0 

0 

a 

1 

z 

1 

reat 

27 

27 

(  3 

0 

0 

0 

0 

0 

0 

1 

D 

a 

1 

z 

1 

raadyt 

28 

2a 

(  3 

0 

0 

0 

0 

0 

0 

0 

B 

a 

1 

z 

] 

paas_tkl 

29 

29 

[  0 

0 

0 

0 

0 

0 

0 

0 

T 

2 

1 

B 

1 

90t_tk2 

30 

128 


30 

(  0 

2 

0 

0 

0 

0 

0 

0 

1 

2 

1 

B 

1 

xiilt2 

31 

31 

{  0 

3 

0 

0 

0 

0 

0 

0 

D 

1 

2 

I 

1 

xevl 

32 

32 

(  1 

3 

0 

0 

0 

0 

0 

0 

D 

1 

2 

1 

1 

xMdyl 

33 

33 

[  0 

3 

0 

0 

0 

0 

0 

0 

■ 

1 

2 

2 

1 

■or*d2 

34 

34 

t  0 

2 

0 

0 

0 

0 

0 

0 

B 

1 

2 

2 

1 

wmi.t2 

35 

35 

(  0 

3 

0 

0 

0 

0 

0 

0 

D 

3 

2 

2 

1 

rari 

36 

36 

(  0 

3 

1 

0 

0 

0 

0 

0 

D 

3 

2 

2 

] 

XMidyS 

37 

37 

(  0 

3 

0 

0 

0 

0 

0 

0 

B 

3 

2 

2 

1 

■or*d2 

38 

3S 

[  0 

2 

0 

0 

0 

0 

0 

0 

B 

3 

2 

2 

1 

sd.t2 

39 

39 

(  0 

3 

0 

0 

0 

0 

0 

0 

D 

4 

2 

2 

1 

rav4 

40 

40 

I  0 

3 

0 

1 

0 

0 

0 

0 

D 

4 

2 

2 

] 

x«ady4 

41 

41 

[  0 

3 

0 

0 

0 

0 

0 

0 

B 

4 

2 

2 

1 

■er*d2 

42 

42 

[  0 

2 

0 

0 

0 

0 

0 

0 

B 

4 

2 

2 

] 

nit2 

43 

43 

[  0 

3 

0 

0 

0 

0 

0 

0 

D 

5 

2 

2 

1 

rev5 

44 

44 

[  0 

3 

0 

0 

1 

0 

0 

0 

D 

5 

2 

2 

1 

raadyS 

45 

45 

[  0 

3 

0 

0 

0 

0 

0 

0 

B 

5 

2 

2 

] 

aor*d2 

46 

46 

(  0 

2 

0 

0 

0 

0 

0 

0 

B 

5 

2 

2 

] 

alt2 

47 

47 

(  0 

3 

0 

0 

0 

0 

0 

0 

D 

6 

2 

2 

] 

rev6 

48 

48 

[  0 

3 

0 

0 

0 

1 

0 

0 

D 

6 

2 

2 

1 

r«ady6 

49 

49 

I  0 

3 

0 

0 

0 

0 

0 

0 

B 

6 

2 

2 

] 

■or«d2 

50 

50 

(  0 

2 

0 

0 

0 

0 

0 

0 

B 

6 

2 

2 

] 

alt2 

51 

51 

(  0 

3 

0 

0 

0 

0 

0 

0 

D 

7 

2 

2 

1 

rc»7 

52 

52 

[  0 

3 

0 

0 

0 

0 

1 

0 

D 

7 

2 

2 

1 

r*ady7 

53 

S3 

[  0 

3 

0 

0 

0 

0 

0 

0 

B 

7 

2 

2 

] 

■or«d2 

54 

54 

(  0 

2 

0 

0 

0 

0 

0 

0 

B 

7 

2 

2 

3 

nlt2 

55 

55 

(  0 

3 

0 

0 

0 

0 

0 

0 

D 

8 

2 

2 

3 

rerB 

56 

56 

(  0 

3 

0 

0 

0 

0 

0 

1 

D 

8 

2 

2 

3 

r«iMly8 

57 

57 

[  0 

3 

0 

0 

0 

0 

0 

0 

B 

8 

2 

2 

3 

paaa_tk2 

58 

58 

(  0 

0 

0 

0 

0 

0 

0 

0 

T 

3 

2 

B 

3 

gat_tk3 

59 

59 

[  0 

0 

2 

0 

0 

0 

0 

0 

B 

3 

2 

B 

3 

xadtS 

60 

60 

1  0 

0 

3 

0 

0 

0 

0 

0 

D 

1 

3 

2 

3 

real 

61 

61 

[  1 

0 

3 

0 

0 

0 

0 

0 

D 

1 

3 

2 

3 

raadyl 

62 

62 

[  0 

0 

3 

0 

0 

0 

0 

0 

B 

1 

3 

2 

3 

anxMia 

63 

63 

[  0 

0 

2 

0 

0 

0 

0 

0 

B 

1 

3 

2 

3 

alts 

64 

64 

(  0 

0 

3 

0 

0 

0 

0 

0 

D 

2 

3 

2 

3 

rov2 

65 

65 

[  0 

1 

3 

0 

0 

0 

0 

0 

D 

2 

3 

2 

3 

r«ady2 

66 

66 

t  0 

0 

3 

0 

0 

0 

0 

0 

B 

2 

3 

2 

3 

anrmU 

67 

67 

(  0 

0 

2 

0 

0 

0 

0 

0 

B 

2 

3 

2 

3 

alts 

68 

68 

(  0 

0 

3 

0 

0 

0 

0 

0 

D 

4 

3 

2 

3 

rov4 

69 

69 

(  0 

0 

3 

1 

0 

0 

0 

0 

D 

4 

3 

2 

3 

aady4 

70 

70 

(  0 

0 

3 

0 

0 

0 

0 

0 

B 

4 

3 

2 

3 

ar*d3 

71 

71 

(  0 

0 

2 

0 

0 

0 

0 

0 

B 

4 

3 

2 

3 

xadtS 

72 

72 

(  0 

0 

3 

0 

0 

0 

0 

0 

D 

5 

3 

2 

3 

rav5 

73 

73 

[  0 

0 

3 

0 

1 

0 

0 

0 

D 

5 

3 

2 

3 

nadyS 

74 

74 

(  0 

0 

3 

0 

0 

0 

0 

0 

B 

5 

3 

2 

3 

arml3 

75 

75 

(  0 

0 

2 

0 

0 

0 

0 

0 

B 

5 

3 

2 

3 

alts 

76 

76 

(  0 

0 

3 

0 

0 

0 

0 

0 

D 

6 

3 

2 

3 

rcv6 

77 

77 

(  0 

0 

3 

0 

0 

1 

0 

0 

D 

6 

3 

2 

3 

aady6 

78 

78 

[  0 

0 

3 

0 

0 

0 

0 

0 

B 

6 

3 

2 

3 

arml3 

79 

79 

(  0 

0 

2 

0 

0 

0 

0 

0 

B 

6 

3 

2 

3 

alt3 

80 

80 

[  0 

0 

3 

0 

0 

0 

0 

0 

D 

7 

3 

2 

3 

rarl 

81 

81 

(  0 

0 

3 

0 

0 

0 

1 

0 

D 

7 

3 

2 

3 

aady7 

82 

82 

[  0 

0 

3 

0 

0 

0 

0 

0 

B 

7 

3 

2 

3 

ar«d3 

83 

83 

(  0 

0 

2 

0 

0 

0 

0 

0 

B 

7 

3 

2 

3 

ait3 

84 

84 

(  0 

0 

3 

0 

0 

0 

0 

0 

D 

8 

3 

2 

3 

rav8 

85 

85 

(  0 

0 

3 

0 

0 

0 

0 

1 

D 

8 

3 

2 

3 

r«ady8 

86 

86 

(  0 

0 

3 

0 

0 

0 

0 

0 

B 

8 

3 

2 

3 

paaa_tk3 

87 

87 

I  0 

0 

0 

0 

0 

0 

0 

0 

T 

4 

3 

B 

3 

9at_tk4 

88 

88 

(  0 

0 

0 

2 

0 

0 

0 

0 

« 

4 

3 

B 

3 

XBit4 

89 

89 

(  0 

0 

0 

3 

0 

0 

0 

0 

D 

1 

4 

2 

3 

real 

90 

90 

(  1 

0 

0 

3 

0 

0 

0 

0 

D 

1 

4 

2 

3 

aadyl 

91 

91 

[  0 

0 

0 

3 

0 

0 

0 

0 

B 

1 

4 

2 

3 

arMl4 

92 

92 

(  0 

0 

0 

2 

0 

0 

0 

0 

B 

1 

4 

2 

3 

alt4 

93 

93 

[  0 

0 

0 

3 

0 

0 

0 

0 

D 

2 

4 

2 

1 

rea2 

94 

94 

(  0 

1 

0 

3 

0 

0 

0 

0 

D 
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